Malicious PDF — malware analysis report

Static analysis result for SHA-256 99dc0141b517e7ac…

MALICIOUS

PDF

21.7 KB Created: 2019-04-30 04:02:21 +01:00 Authoring application: mPDF 5.7
MD5: 80413da76192e2b6d34afec69199c3fc SHA-1: 6b33ae0fd3b0f733af62eb7843238bc15a9042c8 SHA-256: 99dc0141b517e7acfdcb553866db518e1e774ef3600b21d0fb00aed89e1bd3ef
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, characteristic of a link farm or SEO poisoning attack. While the specific URLs extracted were classified as benign, the sheer volume and the heuristic firing indicate a malicious intent to redirect users or manipulate search results. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/6a00a07a08a08a01/Macbeth-Katharina-Thalbach-liest-William-Shakespeare-in-der-bersetzung-von-Thomas-Brasch-1-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a07a00a09a01a07/Macbeth-The-Unabridged-Play-The-Classic-Biography-The-Life-of-William-Shakespeare-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/9a02a08a08a02a00/Macbeth-The-Cambridge-Dover-Wilson-Shakespeare-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a08a05a08a03a01/The-Merchant-of-Venice-Junior-Certificate-English-A-Romantic-Comedy-by-William-Shakespeare-Folens-Shakespeare-Series-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a06a04a07a02a00/Macbeth-New-Swan-Shakespeare-Series-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a02a01a04a09a08/Macbeth-Shakespeare-Appreciated-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/6a03a02a04a06a00/Macbeth-NEW-PENGUIN-SHAKESPEARE-5-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a01a03a04a02a04/Macbeth-HBJ-Shakespeare-1989-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a06a00a07a02a09/Shakespeare-s-Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a02a04a06a01a07/Loue-s-Labor-s-Lost-The-Works-of-William-Shakespeare-According-to-the-Orthography-and-Arrangement-of-the-More-Authentic-Quarto-and-Folio-Versions-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a02a03a05a06a04/The-Complete-Works-of-William-Shakespeare-38-Plays-154-Sonnets-Narrative-Poems-Audiobook-Links-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a01a09a05a07a00/The-Merchant-of-Venice-a-Comedy-Now-Acting-with-Universal-Applause-at-the-Theatres-Royal-in-London-and-Dublin-Written-by-Mr-William-Shakespeare-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a03a02a08a02a03/Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a04a01a06a05a02/Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/9a01a09a06a03a02/Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/3a05a06a02a08a07/Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a02a09a03a04a06/Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a03a04a07a01a08/Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a00a03a07a06a04/Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/6a00a07a05a00a05/Macbeth-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a08a05a08a03a01/The-Merchant-of-Venice-Junior-Certificate-English-A-Romantic-Comedy-by-William-Shakespeare-Folens-Shakespeare-Series-by-William-Shakespe

Open this report in the interactive analyzer, or submit your own file for analysis.