Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3869322fe2e87f1…

MALICIOUS

PDF

25.2 KB Created: 2020-02-19 21:20:01 +00:00 Authoring application: mPDF 5.7
MD5: 149d8446e6347a3a496dc2e3a305c852 SHA-1: 7edf462836c30d300bf29a3782251d4d68af3c3d SHA-256: a3869322fe2e87f130b66980f20ea965f74345ce1732176d98712f61c91281a2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and a critical heuristic for containing a large number of external links. The document body, though heavily obfuscated, contains URLs that appear to be part of a link farm. This suggests the PDF is designed to lure users into clicking malicious links, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/6203205204207201/Discours-de-r-ception-de-rik-Orsenna-l-Acad-mie-fran-aise-et-r-ponse-de-M-Bertrand-Poirot-Delpech-by-rik-Orsenna.pdf
    • http://xiixmcuin.linkpc.net/6203205204203200/L-origine-de-nos-amours-by-rik-Orsenna.pdf
    • http://xiixmcuin.linkpc.net/5207202200200205/La-symbolique-des-lieux-Wie-steht-die-Symbolik-von-Orsenna-in-Verbindung-zum-Romanende-von-Le-Rivage-des-Syrtes-von-Julien-Gracq-by-Lars-Marwinski.pdf
    • http://xiixmcuin.linkpc.net/7200207205208201/Grammaire-Fran-Aise-by-Jacqueline-Ollivier.pdf
    • http://xiixmcuin.linkpc.net/9205201208204204/Guide-de-la-Conversation-Fran-aise-Anglaise-Et-Allemande-Englisch-Franz-sisch-Deutsches-Hilfsbuch-Zur-Leichten-Und-Gr-ndlichen-Erlernung-Der-Konversation-in-Diesen-Drei-Sprachen-by-Hermann-Lambeck.pdf
    • http://xiixmcuin.linkpc.net/6208200204208203/Pratiques-de-la-conduite-du-changement---Comment-passer-du-discours-l-action-Comment-passer-du-discours-l-action-by-David-Autissier.pdf
    • http://xiixmcuin.linkpc.net/3201206209205205/Poirot-Investigates-Hercule-Poirot-3-by-Agatha-Christie.pdf
    • http://xiixmcuin.linkpc.net/2208207200206209/Poirot-The-Complete-Battles-of-Hastings-Vol-2-Hercule-Poirot-amp-Arthur-Hastings-Omnibus-2-by-Agatha-Christie.pdf
    • http://xiixmcuin.linkpc.net/8209209200203/Poirot-The-Complete-Battles-of-Hastings-Vol-1-Hercule-Poirot-amp-Arthur-Hastings-Omnibus-1-by-Agatha-Christie.pdf
    • http://xiixmcuin.linkpc.net/7205203201201/Why-I-am-not-a-Christian---and-other-Essays-on-Religion-and-Related-Subjects-Edited-with-an-Appendix-on-the-Bertrand-Russell-Case-by-Paul-Edwards-by-Bertrand-Russell.pdf
    • http://xiixmcuin.linkpc.net/2207202200206207/From-the-Complaint-Desk-of-Fran-Lewis-I-Speak-the-Truth-You-need-to-Hear-It-by-Fran-Lewis.pdf
    • http://xiixmcuin.linkpc.net/5206207209207207/The-Basic-Writings-of-Bertrand-Russell-1903-1959-by-Bertrand-Russell.pdf
    • http://xiixmcuin.linkpc.net/1201203204205204/Savage-Century-Back-to-Barbarism-by-Th-r-se-Delpech.pdf
    • http://xiixmcuin.linkpc.net/6207208206202208/Comparable-Corpora-and-Computer-Assisted-Translation-by-Estelle-Maryline-Delpech.pdf
    • http://xiixmcuin.linkpc.net/7203209206209200/Pour-cr-er-son-bonheur-en-changeant-sa-fa-on-de-penser-by-Jean-Marie-Delpech.pdf
    • http://xiixmcuin.linkpc.net/8204201203203208/Le-Discours-Gastronomique-Francais-by-Pascal-Ory.pdf
    • http://xiixmcuin.linkpc.net/6201200206202203/Discours-sur-les-d-cades-de-Tite-Live-by-Niccol-Machiavelli.pdf
    • http://xiixmcuin.linkpc.net/5209204205202209/discours-sur-l-origine-et-les-fondements-de-l-in-galit-parmi-les-hommes-by-Jean-Jacques-Rousseau.pdf
    • http://xiixmcuin.linkpc.net/6201200206201209/LA-DESOBEISSANCE-CIVILE-LE-DISCOURS-DE-LA-SERVITUDE-VOLONTAIRE-annot-by-Henry-David-Thoreau.pdf
    • http://xiixmcuin.linkpc.net/8200204205206200/Discours-Dans-Lequel-on-Examine-Les-Deux-Questions-Suivantes-by-Von-Windisch-Graetz-J.pdf
    • http://xiixmcuin.linkpc.net/9205201208204204/Guide-de-la-Conversation-Fran-aise-Anglaise-Et-Allemande-Englisch-Franz-sisch-Deutsches-Hilfsbuch-Zur-Leichten-Und-Gr-ndlichen-Erlernung-Der-Konversation-in-Diesen-Drei-Sprachen-by-Hermann-Lamb

Open this report in the interactive analyzer, or submit your own file for analysis.