Malicious PDF — malware analysis report

Static analysis result for SHA-256 add6658cc46146d9…

MALICIOUS

PDF

20.2 KB Created: 2020-02-14 01:09:09 +00:00 Authoring application: mPDF 5.7
MD5: 25c623c86447300fe162aa9b263cfbb9 SHA-1: 356930bee7d97c171e2617f623f08ae95dc5458b SHA-256: add6658cc46146d9314930e1d39a6f8ff74b919638f15fe7047895fec1637b4a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, many of which point to PDF files with numeric slugs in their URLs. This suggests a link farm or SEO poisoning attack, potentially used to distribute malicious content or drive traffic to malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/1816181688160816881678167/Letters-and-Recollections-of-Julius-and-Mary-Mohl-by-Mary-C-M-Simpson.pdf
    • http://owlaokopdf.myhome.cx/181638166816881638160/Beloved-Prophet-The-Love-Letters-of-Kahlil-Gibran-and-Mary-Haskell-and-Her-Private-Journal-by-Mary-Elizabeth-Haskell.pdf
    • http://owlaokopdf.myhome.cx/1816081678167816381648160/The-Women-of-Easter-Encounter-the-Savior-with-Mary-of-Bethany-Mary-of-Nazareth-and-Mary-Magdalene-by-Liz-Curtis-Higgs.pdf
    • http://owlaokopdf.myhome.cx/1816181628165816981618163/Liebe-Hanya-Mary-Wigman-s-Letters-To-Hanya-Holm-by-Mary-Wigman.pdf
    • http://owlaokopdf.myhome.cx/481658160816481658167/Mary-and-Maria-by-Mary-Wollstonecraft-amp-Matilda-by-Mary-Shelley-by-Mary-Wollstonecraft.pdf
    • http://owlaokopdf.myhome.cx/681618164816781648166/The-Collected-Letters-by-Mary-Wollstonecraft.pdf
    • http://owlaokopdf.myhome.cx/681618164816881688168/The-Life-and-Letters-of-Mary-Wollstonecraft-Shelley-by-Mary-Wollstonecraft-Shelley.pdf
    • http://owlaokopdf.myhome.cx/481658166816681658165/Letters-of-the-Scattered-Brotherhood-by-Mary-Strong.pdf
    • http://owlaokopdf.myhome.cx/681638164816581658163/Letters-from-Malta-A-secret-kept-for-50-years-by-Mary-Rensten.pdf
    • http://owlaokopdf.myhome.cx/681618164816681658160/Letters-Written-During-a-Short-Residence-in-Sweden-Norway-and-Denmark-by-Mary-Wollstonecraft.pdf
    • http://owlaokopdf.myhome.cx/681618164816981668160/The-Life-and-Letters-of-Mary-Wollstonecraft-Shelley-Volume-I-of-2-by-Florence-A-Thomas-Marshall.pdf
    • http://owlaokopdf.myhome.cx/381688164816981618164/Last-Letters-from-Attu-The-True-Story-of-Etta-Jones-Alaska-Pioneer-and-Japanese-POW-by-Mary-Breu.pdf
    • http://owlaokopdf.myhome.cx/7816381658160/Mary-s-Monster-Love-Madness-and-How-Mary-Shelley-Created-Frankenstein-by-Lita-Judge.pdf
    • http://owlaokopdf.myhome.cx/381628165816781658160/Mary-Bloody-Mary-Young-Royals-1-by-Carolyn-Meyer.pdf
    • http://owlaokopdf.myhome.cx/481608162816081638168/Mary-Fields-aka-Stagecoach-Mary-by-Erich-Martin-Hicks.pdf
    • http://owlaokopdf.myhome.cx/481628168816881638167/My-Walk-with-Mary-In-the-Footsteps-of-Bernadette-by-Mary-Marshall.pdf
    • http://owlaokopdf.myhome.cx/1816081688163816181668164/Mary-Mary-Breen-Where-Are-You-by-James-Hugh-Donohoe.pdf
    • http://owlaokopdf.myhome.cx/481658169816681658163/Tender-Bough-Fifty-Poems-by-Mary-Lee-by-Mary-Lee.pdf
    • http://owlaokopdf.myhome.cx/181638162816881698164/MARY-The-Summoning-Bloody-Mary-1-by-Hillary-Monahan.pdf
    • http://owlaokopdf.myhome.cx/481658163816281628160/A-Letter-of-Mary-Mary-Russell-3-by-Laurie-R-King.pdf
    • http://owlaokopdf.myhome.cx/681618164816881688168/The-Life-and-Letters-of-Mary-Wollstonecraft-Shelley-by-Mary-Woll

Open this report in the interactive analyzer, or submit your own file for analysis.