Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9b35059297af666…

MALICIOUS

PDF

15.7 KB Created: 2019-05-02 01:16:24 +01:00 Authoring application: mPDF 5.7
MD5: 714dc3d43fb2e6b948ba99a1872a7114 SHA-1: a72d7a57390a459700315523853ab73e73faf980 SHA-256: a9b35059297af666070808e34a3005c1830789cc44efc9bc820d709df81d1400
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to drive traffic to numerous external PDF files, potentially for SEO poisoning or to host malicious content. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb
    • http://muicuiu.dumb1.com/4a08a07a00a00a08/Crossroad-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/1a02a09a05a05a01/Ladies-of-Mandrigyn-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/2a09a05a02a05a04/Dragonshadow-Winterlands-2-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/1a06a01a04a01a01/The-Walls-of-Air-Darwath-2-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/5a04a08a00a06/Dragonsbane-Winterlands-1-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/2a00a00a05a03a00/Mother-of-Winter-Darwath-4-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/1a05a08a02a05a06/Dog-Wizard-Windrose-Chronicles-3-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/3a01a04a04a07a08/The-Time-of-the-Dark-Darwath-1-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/3a02a00a08a02a00/Die-Upon-a-Kiss-Benjamin-January-5-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/1a07a03a04a08a08/Wet-Grave-Benjamin-January-6-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/2a01a04a01a09a07/Circle-of-the-Moon-Sisters-of-the-Raven-2-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/2a06a08a01a07/The-Ladies-of-Mandrigyn-Sun-Wolf-and-Starhawk-1-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/2a06a09a08a00a03/Those-Who-Hunt-the-Night-James-Asher-1-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/2a01a03a05a03a07/Fever-Season-Benjamin-January-2-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/1a09a06a01a02a05/The-Silent-Tower-Windrose-Chronicles-1-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/3a02a01a01a06a03/Days-of-the-Dead-Benjamin-January-7-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/2a01a08a03a08a04/The-Dark-Hand-of-Magic-Sun-Wolf-and-Starhawk-3-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/1a09a09a04a08a06/Children-of-the-Jedi-Star-Wars-The-Callista-Trilogy-1-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/2a00a04a08a09a06/Beauty-and-the-Beast-Beauty-and-the-Beast-1-by-Barbara-Hambly.pdf
    • http://muicuiu.dumb1.com/5a07a03a04a00a03/Barbara-Pym-Collection-VMC-3-Books-Set-Crampton-Hodnet-Excellent-Women-No-Fond-Return-of-Love-by-Barbara-Pym.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.