Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d30d908e830918b…

MALICIOUS

PDF

21.1 KB Created: 2019-05-01 20:53:37 +01:00 Authoring application: mPDF 5.7
MD5: e75f31175e5a89d90f0d8ed11d548d7e SHA-1: 52c1f94e8bc69c2c8ee41ef18c91c040e98731a9 SHA-256: 9d30d908e830918ba1508daf43916c0991b672ad9fe95e77a3f5168ceb6d9466
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly indicated maliciousness. The primary attack vector appears to be directing users to a dynamic DNS domain hosting numerous documents, likely as a lure or to host further stages of an attack. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9900

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/6b20b22b26b28b29/Veng-du-Comte-Skarbek---tome-1---Deux-mains-d-or-by-Yves-Sente.pdf
    • http://cmeinasaoo.duckdns.org/6b20b22b26b29b21/XIII-english-version---Tome-22---The-Martyr-s-message-by-Yves-Sente.pdf
    • http://cmeinasaoo.duckdns.org/6b20b22b26b23b23/Return-to-Green-Falls-by-Yves-Sente.pdf
    • http://cmeinasaoo.duckdns.org/6b24b20b21b24b29/Les-Skarbek-En-France-Memento-Historique-Pour-La-Branche-Francaise-by-Jean-Skarbek.pdf
    • http://cmeinasaoo.duckdns.org/6b20b22b26b29b22/XIII---Volume-21---Return-to-Green-Falls-XIII-by-Yves-Sente.pdf
    • http://cmeinasaoo.duckdns.org/7b24b28b26b23b23/Revue-Des-Deux-Mondes-by-Tome-Quatri-me.pdf
    • http://cmeinasaoo.duckdns.org/7b29b22b29b22b28/Quatre-cercueils-deux-noirs-et-deux-blancs-by-Pep-Coll.pdf
    • http://cmeinasaoo.duckdns.org/6b20b26b27b29b22/Auguste-Comte-and-Positivism-The-Essential-Writings-by-Auguste-Comte.pdf
    • http://cmeinasaoo.duckdns.org/7b25b22b24b21b20/Pascal-Brutal-Coffret-3-volumes-Tome-1-La-nouvelle-virilit-Tome-2-Le-m-le-dominant-Tome-3-Plus-fort-que-les-plus-forts-by-Riad-Sattouf.pdf
    • http://cmeinasaoo.duckdns.org/6b20b26b28b20b28/Auguste-Comte-The-Foundation-Of-Sociology-by-Auguste-Comte.pdf
    • http://cmeinasaoo.duckdns.org/6b25b25b21b21b25/Deux-fois-les-ennuis-Deux-fois-les-ennuis-Double-Trouble-version-fran-aise-En-Vedette-Mlle-Mabel-et-M-Charley-t-1-by-Louise-Lamontagne.pdf
    • http://cmeinasaoo.duckdns.org/5b25b28b28b29b27/Lolotte-Et-Fanfan-Ou-Les-Aventures-de-Deux-Enfans-Abandon-es-Dans-Une-Isle-D-serte-R-dig-es-amp-Publi-es-Sur-Les-Manuscrits-Anglais-Par-M-Ducray-Du-Minil-Seconde-dition-Revue-amp-Corg-e-Avec-Soin-amp-Augment-e-de-Deux-Gravures-of-4-Volume-1-by-M-Ducray-Duminil.pdf
    • http://cmeinasaoo.duckdns.org/6b20b22b25b21b24/A-orillas-del-r-o-Piedra-me-sent-y-llor-by-Paulo-Coelho.pdf
    • http://cmeinasaoo.duckdns.org/6b24b20b21b25b21/The-Apple-Shouldn-t-Fall-Far-from-Common-Core-Teaching-Techniques-to-Include-All-Students-by-Denise-Skarbek.pdf
    • http://cmeinasaoo.duckdns.org/5b24b20b21b26b24/Ten-Percent-by-G-V-Mains.pdf
    • http://cmeinasaoo.duckdns.org/8b20b25b24b26b22/Ses-mains-sur-ma-peau-by-Marc-Ali.pdf
    • http://cmeinasaoo.duckdns.org/5b24b20b20b22b24/Grains-As-Mains-by-Laura-Agar-Wilson.pdf
    • http://cmeinasaoo.duckdns.org/5b24b20b20b26b29/The-Screaming-Book-of-Horror-by-Johnny-Mains.pdf
    • http://cmeinasaoo.duckdns.org/5b24b20b21b27b20/Bite-Sized-Horror-by-Johnny-Mains.pdf
    • http://cmeinasaoo.duckdns.org/6b20b26b27b29b23/Dictionary-of-Mythology-by-Fernand-Comte.pdf
    • http://cmeinasaoo.duckdns.org/7b25b22b24b21b20/Pascal-Brutal-Coffret-3-volumes-

Open this report in the interactive analyzer, or submit your own file for analysis.