Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9b22f40766d11dc…

MALICIOUS

PDF

18.8 KB Created: 2019-05-07 05:12:15 +01:00 Authoring application: mPDF 5.7
MD5: 266bc6cd6b02f402f1f2d7f70ef8a653 SHA-1: fdd6913cceec48723e2455b18a83e62c1bca9d58 SHA-256: a9b22f40766d11dcb61d55a844825fb70dac5ff6d93fbdbc8d290777e01f5071
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a link farm. While most linked URLs are benign, the heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links. The ML classifier also flagged the PDF as malicious with high confidence. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the specific lure or payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/4a08a05a03a07a07/How-a-Realist-Hero-Rebuilt-the-Kingdom-Volume-1-Realist-Hero-1-by-Dojyomaru.pdf
    • http://muicuiu.dumb1.com/4a01a08a04a05a00/-devils-and-realist-1-Makai-Ouji-Devils-and-Realist-1-Devils-and-Realist-1-by-Madoka-Takadono.pdf
    • http://muicuiu.dumb1.com/2a04a01a00a06/The-Realist-Cartoons-by-Art-Spiegelman.pdf
    • http://muicuiu.dumb1.com/5a00a08a03a07a04/The-Empire-of-Civil-Society-A-Critique-of-the-Realist-Theory-of-International-Relations-by-Justin-Rosenberg.pdf
    • http://muicuiu.dumb1.com/3a00a07a06a07/The-Hero-39-s-Guide-to-Saving-Your-Kingdom-by-Christopher-Healy.pdf
    • http://muicuiu.dumb1.com/9a08a06a01a09/Prelude-to-a-Hero-Chronicles-of-a-Hero-1-by-Jaime-Buckley.pdf
    • http://muicuiu.dumb1.com/3a04a09a01a05a07/Hero-in-the-Highlands-No-Ordinary-Hero-1-by-Suzanne-Enoch.pdf
    • http://muicuiu.dumb1.com/4a01a04a08a09a09/Her-Forbidden-Hero-The-Hero-1-by-Laura-Kaye.pdf
    • http://muicuiu.dumb1.com/5a06a09a00a02/One-Night-with-a-Hero-The-Hero-2-by-Laura-Kaye.pdf
    • http://muicuiu.dumb1.com/9a01a03a08a00/Resenting-the-Hero-Hero-1-by-Moira-J-Moore.pdf
    • http://muicuiu.dumb1.com/1a00a03a09a06a01a07/My-Hero-Academia-Vol-4-Der-Junge-dem-alles-in-die-Wiege-gelegt-wurde-My-Hero-Academia-4-by-Kohei-Horikoshi.pdf
    • http://muicuiu.dumb1.com/2a04a00a09a02a07/Big-Hero-6-Junior-Novelization-Disney-Big-Hero-6-by-Walt-Disney-Company.pdf
    • http://muicuiu.dumb1.com/1a01a02a09a07a06/--1-Boku-No-Hero-Academia-1-My-Hero-Academia-1-by-Kohei-Horikoshi.pdf
    • http://muicuiu.dumb1.com/2a01a00a01a00a02/G-I-Joe-A-Real-American-Hero-Volume-1-by-Larry-Hama.pdf
    • http://muicuiu.dumb1.com/1a07a03a02a07a08/Hero-Hero-1-by-Leighton-Del-Mia.pdf
    • http://muicuiu.dumb1.com/6a00a08a01a03a03/Obnoxious-Hero-kun-Obnoxious-Hero-kun-1-by-Amanda-Rahimi.pdf
    • http://muicuiu.dumb1.com/3a02a02a04a02a04/The-Hero-Always-Wins-The-Hero-Always-Wins-1-by-Robert-Eaton.pdf
    • http://muicuiu.dumb1.com/1a03a04a08a05a04/The-Forever-Hero-Forever-Hero-1-3-by-L-E-Modesitt-Jr-.pdf
    • http://muicuiu.dumb1.com/4a04a02a09a08a01/Drew-Bradley-s-Hero-Volume-1-1-Episodes-1-8-Story-Arc-1-The-Beginning-by-Drew-Bradley.pdf
    • http://muicuiu.dumb1.com/2a05a07a01a08a04/My-Hero-by-Max-Vos.pdf
    • http://muicuiu.dumb1.com/9a08a06a01a09/Prelude-to-a-Hero-Chronicles-of-a-Hero-1-by-Jaime-Buck

Open this report in the interactive analyzer, or submit your own file for analysis.