Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa472d85898e4b71…

MALICIOUS

PDF

14.5 KB Created: 2019-05-02 01:38:16 +01:00 Authoring application: mPDF 5.7
MD5: 5fbfe7b18671a63e9ccc256e7e0d504c SHA-1: e928ab9514cc0f9f599f2df49f47e3ef00f622ca SHA-256: aa472d85898e4b71b403707f59e458ccfe31a5a04a8283b2dfd72de3d1e3f7df
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently classified as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or as a distribution vector for other malware. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb
    • http://muicuiu.dumb1.com/2a09a04a00a06a01/Diary-of-a-Wimpy-Kid-1-4-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/7a08a01a04a04a03/Diary-of-a-Wimpy-Kid-Book-1-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/6a03a03a04a06a05/Diary-Of-A-Wimpy-Kid-Book-1-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/3a04a00a04a04/Rodrick-Rules-Diary-of-a-Wimpy-Kid-2-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/4a08a09a04a09a06/Rodrick-Rules-Diary-of-a-Wimpy-Kid-2-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/2a07a04a00a02a01/Hard-Luck-Diary-of-a-Wimpy-Kid-8-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/4a00a01a03a00a05/Hard-Luck-Diary-of-a-Wimpy-Kid-8-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/4a00a00a03a09/Hard-Luck-Diary-of-a-Wimpy-Kid-8-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/7a03a05a04a01a07/Sneet-inde-Diary-of-a-Wimpy-Kid-6-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/5a09a02a06a05a07/Diary-of-a-Wimpy-Kid-Book-1-Special-Edition-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/7a08a01a05a01a07/The-Ugly-Truth-Diary-of-a-Wimpy-Kid-Series-5-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/4a07a02a04a04/The-Wimpy-Kid-Movie-Diary-How-Greg-Heffley-Went-Hollywood-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/5a09a07a09a00a03/Diary-of-a-Minecraft-Iron-Golem-by-Diary-Wimpy.pdf
    • http://muicuiu.dumb1.com/2a09a09a01a00a04/Diary-of-a-Wimpy-Vampire-Prince-of-Dorkness-by-Tim-Collins.pdf
    • http://muicuiu.dumb1.com/3a09a09a09a09a07/Diary-of-a-Wimpy-Kid-Teacher-Guide-Novel-Units-by-Linda-Herman.pdf
    • http://muicuiu.dumb1.com/6a07a08a06a00a01/Journal-d-un-d-gonfl-t-10-Z-ro-r-seau-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/6a07a08a06a00a00/Un-looong-voyage-Journal-d-un-d-gonfl-tome-9-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/7a03a05a03a09a04/Mannys-man-ver-Dagbok-f-r-alla-mina-fans-6-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/7a04a03a07a00a00/Journal-d-un-d-gonfl-t-1-Carnet-de-bord-de-Greg-Heffley-by-Jeff-Kinney.pdf
    • http://muicuiu.dumb1.com/6a04a06a06a09a08/Gregs-bravader-Dagbok-f-r-alla-mina-fans-1-by-Jeff-Kinney.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.