Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5b4de825f69ca7d…

MALICIOUS

PDF

20.8 KB Created: 2019-05-01 18:40:50 +01:00 Authoring application: mPDF 5.7
MD5: 9d4cdbce0088bdf338dd98aaa69ac833 SHA-1: 9290e29fb991e4fc9af522c7827940d0133e1d0c SHA-256: a5b4de825f69ca7d162ab9c9dd45fb8b51d610e8e323c1c2175a63da79760f3c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, many of which are hosted on the dynamic DNS domain 'unieoooq.linkpc.net'. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier strongly supports the malicious verdict. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://unieoooq.linkpc.net/14e14e84e94e94e14e4/The-Small-House-at-Allington-by-Anthony-Trollope-Complete-Volume-1-and-2-Illustrated-Sir-John-Everett-Millais-1st-Baronet-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/14e14e84e94e94e04e9/Phineas-Finn-the-Irish-Member-a-Novel-by-Anthony-Trollope-in-Two-Volume-Illustrated-by-Sir-John-Everett-Millais-1st-Baronet-Pra-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/24e74e04e14e44e4/The-Short-Stories-of-Anthony-Trollope-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/64e84e64e94e74e9/Way-We-Live-Now-Trollope-1992-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/44e34e14e94e94e8/The-Complete-Yes-Prime-Minister-by-Jonathan-Lynn.pdf
    • http://unieoooq.linkpc.net/14e04e04e14e54e2/The-Man-from-Halifax-Sir-John-Thompson-Prime-Minister-by-P-B-Waite.pdf
    • http://unieoooq.linkpc.net/24e64e34e84e84e2/The-Prime-Minister-s-Secret-Agent-Maggie-Hope-4-by-Susan-Elia-MacNeal.pdf
    • http://unieoooq.linkpc.net/54e94e44e14e44e2/A-short-history-of-a-ten-years-negociation-between-a-Prime-Minister-and-a-private-gentleman-by-Robert-Whatley.pdf
    • http://unieoooq.linkpc.net/14e14e74e04e94e0/Notes-to-the-Prime-Minister---The-Untold-Story-of-How-Malaysia-Beat-the-Currency-Speculators-by-Sulong-Wong.pdf
    • http://unieoooq.linkpc.net/54e04e14e34e54e0/The-Warden-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/44e94e94e14e44e2/Kept-in-the-Dark-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/74e94e84e74e74e9/Can-You-Forgive-Her-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/44e64e64e84e84e6/The-Way-We-Live-Now-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/54e54e14e64e24e7/The-Lady-of-Launay-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/44e84e74e14e74e7/The-Belton-Estate-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/84e14e94e14e14e6/The-Life-Of-Cicero-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/24e24e34e44e54e0/Barchester-Towers-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/54e04e34e64e44e7/Doctor-Thorne-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/34e74e14e84e74e0/Barchester-Towers-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/14e64e64e94e14e1/Dr-Wortle-s-School-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/14e04e04e14e54e2/The-Man-from-Halifax-Sir-J

Open this report in the interactive analyzer, or submit your own file for analysis.