Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae68b2053697badf…

MALICIOUS

PDF

17.8 KB Created: 2020-02-09 23:43:19 +00:00 Authoring application: mPDF 5.7
MD5: 812dbec7fa5ec19c7055ab6fe35918de SHA-1: 3b3f873369201dd8d70968b19a330f50a32ed78c SHA-256: ae68b2053697badf5cf0ca1bd95593aa7ad4bb19123f80778af9ae287b93d9d0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The embedded links, such as http://tuiwckiko.jpn.ph/75d15d35d15d05d9/Frankenstein-By-Mary-Wollstonecraft-Shelley-amp-Illustrated-An-Audiobook-Free-by-Mary-Wollstonecraft-Shelley.pdf, likely serve as a lure to redirect users to malicious websites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tuiwckiko.jpn.ph/75d15d35d15d05d9/Frankenstein-By-Mary-Wollstonecraft-Shelley-amp-Illustrated-An-Audiobook-Free-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/85d45d95d05d95d0/Frankenstein-Mary-Shelley-The-Modern-Prometheus-Frankenstein-s-Monster-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/85d25d65d35d55d5/The-Frankenstein-Notebooks-A-Facsimile-Edition-of-Mary-Shelley-s-Manuscript-Novel-1816-17-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/65d15d05d05d15d3/Frankenstein-Galvanised-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/65d75d55d95d05d4/The-New-Annotated-Frankenstein-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/55d55d05d95d35d9/Victor-Frankenstein-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/85d25d15d85d95d2/Frankenstein-Con-2-audiocassette-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/85d45d45d95d75d6/Frankenstein-Or-the-Modern-Prometheus-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/65d95d05d25d45d0/Frankenstein-or-the-Modern-Prometheus-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/65d15d45d65d75d6/Mary-Wollstonecraft-Shelley-s-Frankenstein-by-Bernie-Wrightson.pdf
    • http://tuiwckiko.jpn.ph/65d55d35d25d85d5/Frankenstein-or-The-Modern-Prometheus-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/75d15d15d35d85d4/Frankenstein-narrated-by-Dan-Stevens-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/55d45d25d45d05d0/Frankenstein-or-Modern-Prometheus-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/75d15d65d85d05d9/Frankenstein-Or-The-Modern-Prometheus-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/55d35d05d05d55d3/Frankenstein-or-The-Modern-Prometheus-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/85d85d15d75d05d7/Frankenstein-or-The-modern-Prometheus-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/55d35d85d65d65d6/Frankenstein-Plus-Best-American-Essay-2003-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/95d45d65d85d95d5/Frankenstein-with-Illustrations-by-Nino-Carbe-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/65d75d55d75d55d1/Frankenstein-The-Graphic-Novel-Original-Text-by-Mary-Wollstonecraft-Shelley.pdf
    • http://tuiwckiko.jpn.ph/55d65d75d85d35d7/Frankenstein---playscript-adapted-by-Philip-Pullman-by-Mary-Wollstonecraft-Shelley.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.