Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab0fe82593ff3788…

MALICIOUS

PDF

16.7 KB Created: 2020-03-18 21:58:05 +00:00 Authoring application: mPDF 5.7
MD5: b1d5175d993bf43a625a6bcdf2257bca SHA-1: 86cbd680b4650811a73ba7809860268d1afc97de SHA-256: ab0fe82593ff3788c8d4e2fe168d9de040fcbed11252ac8caf8fd1137bfaaddd
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified as a PDF SEO link farm. The primary purpose appears to be directing users to a large collection of external PDF files hosted on the domain 'ieuicufioao.myhome.cx'. While no scripts were extracted, the sheer volume of links and the ML classifier's high confidence suggest a malicious intent, likely for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9788

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ieuicufioao.myhome.cx/8554559554555557/Surprised-Pink-Geraniums-A-Memoir-by-Pat-Brown.pdf
    • http://ieuicufioao.myhome.cx/4553557556559552/This-River-A-Memoir-by-James-Brown.pdf
    • http://ieuicufioao.myhome.cx/2555552555556552/Shades-of-Pink-Lola-Pink-Mysteries-1-by-Gina-LaManna.pdf
    • http://ieuicufioao.myhome.cx/2553551552559558/Little-Things-A-Memoir-in-Slices-by-Jeffrey-Brown.pdf
    • http://ieuicufioao.myhome.cx/2559556554557550/Leaving-Church-A-Memoir-of-Faith-by-Barbara-Brown-Taylor.pdf
    • http://ieuicufioao.myhome.cx/3552554553553553/The-Secret-History-of-the-Pink-Carnation-Pink-Carnation-1-by-Lauren-Willig.pdf
    • http://ieuicufioao.myhome.cx/4557552555558559/The-Secret-History-of-the-Pink-Carnation-Pink-Carnation-1-by-Lauren-Willig.pdf
    • http://ieuicufioao.myhome.cx/2557558558556553/The-Secret-History-of-the-Pink-Carnation-Pink-Carnation-1-by-Lauren-Willig.pdf
    • http://ieuicufioao.myhome.cx/3550551555559557/Surprised-by-Oxford-by-Carolyn-Weber.pdf
    • http://ieuicufioao.myhome.cx/4553556550553557/Surprised-by-Joy-The-Shape-of-My-Early-Life-by-C-S-Lewis.pdf
    • http://ieuicufioao.myhome.cx/6556552554554559/Horace-Splattly-the-Cupcake-Crusader-The-Terror-of-the-Pink-Dodo-Ballo-The-Terror-of-the-Pink-Dodo-Balloons-by-Lawrence-David.pdf
    • http://ieuicufioao.myhome.cx/8554559555552554/The-Red-Geraniums-by-J-Schlenker.pdf
    • http://ieuicufioao.myhome.cx/1551554556554552558/Julia-Pink-Outdoor-Erotik-f-rs-Ohr-by-Julia-Pink.pdf
    • http://ieuicufioao.myhome.cx/2554554552555552/My-Summer-of-Pink-amp-Green-Pink-amp-Green-2-by-Lisa-Greenwald.pdf
    • http://ieuicufioao.myhome.cx/3551557553550554/Pink-Floyd---Dark-Side-of-the-Moon-by-Pink-Floyd.pdf
    • http://ieuicufioao.myhome.cx/2550552552550558/Surprised-by-Love-A-Contemporary-Romance-The-Armstrongs-4-by-Jessica-Gray.pdf
    • http://ieuicufioao.myhome.cx/8554559554554558/Hardy-Geraniums-by-Peter-Yeo.pdf
    • http://ieuicufioao.myhome.cx/7556554559555551/Surprised-by-Suffering-The-Role-of-Pain-and-Death-in-The-Christian-Life-by-R-C-Sproul.pdf
    • http://ieuicufioao.myhome.cx/8554559555558555/My-Little-White-Geraniums-by-Brandon-Berntson.pdf
    • http://ieuicufioao.myhome.cx/8554559552559550/Geraniums-and-Pelargoniums-by-John-Feltwell.pdf
    • http://ieuicufioao.myhome.cx/655655255

Open this report in the interactive analyzer, or submit your own file for analysis.