Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae6c1d1f5cc34d34…

MALICIOUS

PDF

17.6 KB Created: 2019-05-07 02:52:48 +01:00 Authoring application: mPDF 5.7
MD5: af78da143bc9f4b8dc90e3c0fa8a6cf7 SHA-1: 10d0df778b44b0e92fb5696eafe7333ed5c01d89 SHA-256: ae6c1d1f5cc34d346530161593e74fb1cb16649246903d08d724e29d4e15f739
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which are disguised as book titles. These links predominantly point to the same domain, xiixmcuin.linkpc.net, suggesting a coordinated effort to drive traffic to potentially malicious content. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of this document. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/6207205209200202/Frankenstein-by-John--Green.pdf
    • http://xiixmcuin.linkpc.net/4200209205205/John-Green-the-Collection-Looking-for-Alaska-An-Abundance-of-Katherines-Paper-Towns-Will-Grayson-Will-Grayson-The-Fault-in-Our-Stars-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/3201200202202208/Green-Smoothie-Everyday-Green-Smoothie-For-Beginners-10-Day-Green-Smoothie-Cleanse-green-smoothies-green-smoothies-detox-green-smoothies-recipes-green-Diet-healthy-food-for-everyday-Book-9-by-Anna-Scott.pdf
    • http://xiixmcuin.linkpc.net/9203201203205204/D-steres-Verlangen-Die-wahre-Geschichte-des-jungen-Victor-Frankenstein-The-Apprenticeship-of-Victor-Frankenstein-1-by-Kenneth-Oppel.pdf
    • http://xiixmcuin.linkpc.net/3206205202204201/Let-It-Snow-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/4205208202/Let-it-Snow-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/1204201203203203/Let-It-Snow-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/2207202201209205/Looking-for-Alaska-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/8209203203201205/Looking-for-Alaska-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/1200207200204204/Paper-Towns-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/7201205201204208/The-Fault-in-Our-Stars-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/1204200203208201/Green-Soldiers-by-John-Bensko.pdf
    • http://xiixmcuin.linkpc.net/8206200209207/The-Fault-in-Our-Stars-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/4200208202200201/Paper-Towns-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/5207202202207204/Die-Fout-by-Ons-Sterre-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/9206201207/The-Fault-in-Our-Stars-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/2204209203200201/An-Abundance-of-Katherines-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/1201200200202203204/Krive-so-zvezde-by-John-Green.pdf
    • http://xiixmcuin.linkpc.net/1201207201207207/Fried-Green-Zombies-by-John-A-Allen.pdf
    • http://xiixmcuin.linkpc.net/3200208206207/The-Green-Ripper-Travis-McGee-18-by-John-D-MacDonald.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.