Malicious PDF — malware analysis report

Static analysis result for SHA-256 a00e5097f33fb4c1…

MALICIOUS

PDF

18.0 KB Created: 2020-03-15 21:10:09 +00:00 Authoring application: mPDF 5.7
MD5: d1dc2b03c86986de30ffe136bd4289cc SHA-1: 9a5ad24a2659f66af1bd3290194eb36098182218 SHA-256: a00e5097f33fb4c13989d556cff8d10396ceaa587f7993467fabcf5f1405a6b1
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to external resources, suggesting a link farm or redirection mechanism. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. The primary attack pattern involves social engineering through these links, likely to deliver a secondary payload or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rtuninnsi.myhome.cx/56a16a86a36a46a1/For-Those-Who-Hunt-the-Wounded-Down-by-David-Adams-Richards.pdf
    • http://rtuninnsi.myhome.cx/46a86a96a26a76a1/Incidents-in-the-Life-of-Markus-Paul-by-David-Adams-Richards.pdf
    • http://rtuninnsi.myhome.cx/46a86a06a46a46a1/Evening-Snow-Will-Bring-Such-Peace-by-David-Adams-Richards.pdf
    • http://rtuninnsi.myhome.cx/36a86a06a66a26a2/Friends-Fugues-and-Fortune-Cookies-by-Michelle-Schusterman.pdf
    • http://rtuninnsi.myhome.cx/16a96a36a06a26a0/The-Balkan-Trilogy-The-Great-Fortune-The-Spoilt-City-Friends-and-Heroes-by-Olivia-Manning.pdf
    • http://rtuninnsi.myhome.cx/16a16a26a16a16a56a6/Friends-Stories-About-New-Friends-Old-Friends-And-Unexpectedly-True-Friends-by-Ann-M-Martin.pdf
    • http://rtuninnsi.myhome.cx/36a46a26a56a26a9/Fortune-69-by-David-Heath.pdf
    • http://rtuninnsi.myhome.cx/26a76a66a96a2/Worst-of-Friends-Thomas-Jefferson-John-Adams-and-the-True-Story-of-an-American-Feud-by-Suzanne-Tripp-Jurmain.pdf
    • http://rtuninnsi.myhome.cx/16a16a46a56a06a5/Soldier-Boys-by-David-Richards.pdf
    • http://rtuninnsi.myhome.cx/16a66a26a66a46a1/The-Lady-at-Batoche-by-David-Richards.pdf
    • http://rtuninnsi.myhome.cx/16a56a36a16a76a2/The-Lovely-Past-by-David-Richards.pdf
    • http://rtuninnsi.myhome.cx/56a86a26a96a86a8/The-Wolf-Cub-Soldier-of-Fortune-1-by-David-Pilling.pdf
    • http://rtuninnsi.myhome.cx/16a06a46a06a06a76a3/Death-of-a-Bankster-Maddie-Richards-Mystery-2-by-David-Bishop.pdf
    • http://rtuninnsi.myhome.cx/16a26a56a96a96a3/The-Immortal-Irishman-Thomas-Meager-and-the-Invention-of-Irish-America-by-Tim-Egan.pdf
    • http://rtuninnsi.myhome.cx/36a36a46a76a86a6/Change-of-Fortune-Miss-Fortune-Mystery-11-by-Jana-Deleon.pdf
    • http://rtuninnsi.myhome.cx/26a66a66a56a26a7/John-Adams-by-David-McCullough.pdf
    • http://rtuninnsi.myhome.cx/26a36a06a46a3/John-Adams-by-David-McCullough.pdf
    • http://rtuninnsi.myhome.cx/76a26a76a46a76a6/John-Adams-by-David-McCullough.pdf
    • http://rtuninnsi.myhome.cx/66a16a16a36a76a2/John-Adams-Part-2-of-2-by-David-McCullough.pdf
    • http://rtuninnsi.myhome.cx/16a66a76a16a16a6/Gotcha-18-Amazing-Ways-to-Freak-Out-Your-Friends-by-David-Acer.pdf
    • http://rtuninnsi.myhome.cx/16a16a26a16a16a56a6/Friends-Stories-About-New-Friends-Old-Fri

Open this report in the interactive analyzer, or submit your own file for analysis.