Malicious PDF — malware analysis report

Static analysis result for SHA-256 a761d24ab068c5f9…

MALICIOUS

PDF

29.6 KB Created: 2019-04-30 08:17:16 +01:00 Authoring application: mPDF 5.7
MD5: 6672fd3ea4e71c2f090ebdc82d0d27e1 SHA-1: 6e7beb44309c0af56f298690cdd7697f4ce1e15c SHA-256: a761d24ab068c5f91e82af7e186d503baae97da485b9ee4525d793fde90b282e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to malicious sites. While the document body is heavily obfuscated, the presence of numerous links to external PDFs suggests a lure or redirection mechanism. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9903

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://unieoooq.linkpc.net/14e04e44e44e24e04e0/Zwangsarbeit-in-Der-Land--Und-Forstwirtschaft-Auf-Dem-Gebiet-Osterreichs-1939-1945-Zwangsarbeit-Auf-Dem-Gebiet-Der-Republik-Osterreich-2-by-Peter-Ruggenthaler.pdf
    • http://unieoooq.linkpc.net/14e04e44e44e14e94e7/Die-Lage-Der-Deutschen-Im-Konigsberger-Gebiet-1945-1948-by-Gerhild-Luschnat.pdf
    • http://unieoooq.linkpc.net/64e34e74e04e34e7/Das-KZ-Bordell-sexuelle-Zwangsarbeit-in-nationalsozialistischen-Konzentrationslagern-by-Robert-Sommer.pdf
    • http://unieoooq.linkpc.net/14e04e44e44e14e94e6/Syntaktische-Forscshungen-Auf-Dem-Gebiet-Des-Spatlateins-by-Dag-Norberg.pdf
    • http://unieoooq.linkpc.net/14e04e44e44e14e44e7/Fernhandelsstra-en-im-Mittelalter-im-Gebiet-der-Lausitz-by-Paul-Rosen.pdf
    • http://unieoooq.linkpc.net/14e04e44e44e34e14e2/Groae-Fluesse-Auf-Dem-Gebiet-Der-Bundesrepublik-Deutschland-by-Ulf-Borchers.pdf
    • http://unieoooq.linkpc.net/14e04e44e44e24e84e1/Das-Analogiedenken-Vorst-e-In-Ein-Neues-Gebiet-Der-Rationalit-tstheorie-by-Karen-Gloy.pdf
    • http://unieoooq.linkpc.net/14e04e44e44e34e14e1/Die-Laubmoose-Im-Ruovesi-Virrat-Gebiet-In-West-Finnland-by-Niilo-Soyrinki.pdf
    • http://unieoooq.linkpc.net/14e04e44e44e34e24e3/Einfa1-4hrung-in-Die-Theorie-Der-Differentialgleichungen-Im-Reellen-Gebiet-by-Ludwig-Bieberbach.pdf
    • http://unieoooq.linkpc.net/14e04e44e44e24e94e3/Neu-Gluckstal-Im-Gebiet-Odessa-Eine-Typische-Siedlung-Der-Russlanddeutschen-by-Richard-H-Walth.pdf
    • http://unieoooq.linkpc.net/14e04e14e34e54e04e3/Die-K-mpfe-im-Drei-Zinnen-Gebiet-und-am-Kreuzberg-in-Sexten-1915-1917-by-Viktor-Schemfil.pdf
    • http://unieoooq.linkpc.net/14e14e04e74e44e94e0/Aus-den-Tageb-chern-von-Joseph-Goebbels-seine-Unterredungen-mit-Adolf-Hitler-1939-1945-Band-2-Januar-1943---M-rz-1945-by-Anton-F-Schimmelpfennig.pdf
    • http://unieoooq.linkpc.net/14e04e14e34e54e34e6/Die-K-mpfe-Im-Drei-Zinnen-Gebiet-Und-Am-Kreuzberg-In-Sexten-1915-1917-Verfasst-Auf-Grund-sterreichischer-Kriegsakten-Schilderungen-Von-Mitk-mpfern-Und-Italienischer-Kriegsgeschichtlicher-Werke-by-Viktor-Schemfil.pdf
    • http://unieoooq.linkpc.net/14e14e64e54e44e94e8/Lebensbedingungen-Und-Entwicklungsmoeglichkeiten-Junger-Tuerkischer-Frauen-in-Einem-Laendlich-Strukturierten-Gebiet-Der-Bundesrepublik-Deutschland---Dargestellt-Am-Beispiel-Des-Landkreises-Marburg--Biedenkopf-by-Silke-Lorch-Gollner.pdf
    • http://unieoooq.linkpc.net/94e84e24e94e64e6/Von-Travnicek-Bis-Hinterholz-8-Kabarett-In-Osterreich-Ab-1945-Von-A-Bis-Zugabe-by-Iris-Fink.pdf
    • http://unieoooq.linkpc.net/14e14e74e24e74e94e3/Zwischen-Arbeit-Spiel-Und-Schule-Die-Okonomische-Funktion-Der-Kinder-Armerer-Schichten-in-Osterreich-188---1939-by-Maria-Papathanassiou.pdf
    • http://unieoooq.linkpc.net/14e14e54e04e14e24e9/Unerh-rte-Lektionen-Journalistische-Spurensuche-In-sterreich-1945-1955-by-Wolfgang-R-Langenbucher.pdf
    • http://unieoooq.linkpc.net/14e14e74e24e74e04e2/Zwischen-Arbeit-Spiel-Und-Schule-Die-Okonomische-Funktion-Der-Kinder-Armerer-Schichten-in-Osterreich-1880-1939-by-Maria-Papathanassiou.pdf
    • http://unieoooq.linkpc.net/44e24e34e14e04e6/All-Hell-Let-Loose-The-World-at-War-1939-1945-by-Max-Hastings.pdf
    • http://unieoooq.linkpc.net/54e24e54e94e24e4/The-Warsaw-Underground-A-Memoir-of-Resistance-1939-1945-by-Jan-Rosinski.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.