Malicious PDF — malware analysis report

Static analysis result for SHA-256 9921efac3c9cbe48…

MALICIOUS

PDF

19.5 KB Created: 2020-03-18 21:02:13 +00:00 Authoring application: mPDF 5.7
MD5: 339d2dbdc1ac290a2955223476abadd0 SHA-1: b14a3bc20696fdf1abaf4b556ffb09d9a79c7096 SHA-256: 9921efac3c9cbe480be4bb22384a90b76a3f33312ab6619c56bae8150ca38157
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The primary attack pattern appears to be the distribution of a link farm, likely to redirect users to malicious sites or to manipulate search engine results. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9775

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://calistazz.myhome.cx/4865866865865865/Claiming-the-Knights-by-S-E-Leonard.pdf
    • http://calistazz.myhome.cx/3860862862860860/Claiming-the-Prince-Part-Three-Claiming-the-Prince-3-by-Cora-Avery.pdf
    • http://calistazz.myhome.cx/3860862862860862/Claiming-the-Prince-Part-Four-Claiming-the-Prince-4-by-Cora-Avery.pdf
    • http://calistazz.myhome.cx/6869867861862863/Arabian-Knights---Volume1-Knights-of-Arabia-1-by-Aisha-Bilal.pdf
    • http://calistazz.myhome.cx/6862862869864/Knights-Templar-Knights-of-Christ-Fakta-Rahasia-Yang-Tak-Terungkap-The-Da-Vinci-Code-by-Rizki-Ridyasmara.pdf
    • http://calistazz.myhome.cx/2869860864861868/Girls-Can-t-Be-Knights-Spirit-Knights-Book-1-by-Lee-French.pdf
    • http://calistazz.myhome.cx/1867865863868860/The-Blessed-Knights-Secret-Knights-2-by-Mary-Ting.pdf
    • http://calistazz.myhome.cx/1860867866866866868/Leonard-Zett-The-Male-Nude-Photo-CD-Die-M-nnerakt-Foto-CD-by-Leonard-Zett.pdf
    • http://calistazz.myhome.cx/3860864866864864/Subliminal-How-You-Unconscious-Mind-Rules-Your-Behaviour-Leonard-Mlodinow-by-Leonard-Mlodinow.pdf
    • http://calistazz.myhome.cx/7865860865861/The-Complete-Western-Stories-of-Elmore-Leonard-by-Elmore-Leonard.pdf
    • http://calistazz.myhome.cx/4860868862860863/Knights-of-the-Blood-Knights-of-the-Blood-1-by-Scott-MacMillan.pdf
    • http://calistazz.myhome.cx/3863869867864860/Star-Wars-Knights-of-the-Old-Republic-Vol-3-Days-of-Fear-Nights-of-Anger-Star-Wars-Knights-of-the-Old-Republic-3-by-John-Jackson-Miller.pdf
    • http://calistazz.myhome.cx/3863869863861868/Star-Wars-Knights-of-the-Old-Republic-Vol-1-Commencement-Star-Wars-Knights-of-the-Old-Republic-1-by-John-Jackson-Miller.pdf
    • http://calistazz.myhome.cx/3863869861862867/Star-Wars-Knights-of-the-Old-Republic-Vol-6-Vindication-Star-Wars-Knights-of-the-Old-Republic-6-by-John-Jackson-Miller.pdf
    • http://calistazz.myhome.cx/1869868861867868/Claiming-Her-Geeks-by-Eve-Langlais.pdf
    • http://calistazz.myhome.cx/1862863867865862/Claiming-His-Wife-Unlikely-Love-3-by-Sam-Crescent.pdf
    • http://calistazz.myhome.cx/3864866866866/Claiming-Breath-by-Diane-Glancy.pdf
    • http://calistazz.myhome.cx/4862867869868862/The-Claiming-of-Sleeping-Beauty-by-A-N-Roquelaure.pdf
    • http://calistazz.myhome.cx/6863865862863862/The-Claiming-of-Jake-Erikson-by-T-J-Vendredi.pdf
    • http://calistazz.myhome.cx/1861860861860862860/Claiming-Danny-Tomboy-Slut-1-by-A-V-Roe.pdf
    • http://calistazz.myhome.cx/3860864866864864/Subliminal-How-You-Unconscious-Mind-Rules-Your-Behaviour-Leonard-Mlodinow-by-Leonard-Mlodinow.p