Malicious PDF — malware analysis report

Static analysis result for SHA-256 af8ab61e4119ca6a…

MALICIOUS

PDF

26.3 KB Created: 2019-05-07 03:25:22 +01:00 Authoring application: mPDF 5.7
MD5: 4d237ea32c92681e9d3030af6f8c6308 SHA-1: 2fde146042143f1e31dfb5556961749eb4a95f9e SHA-256: af8ab61e4119ca6afa2549258fb427a14aaec9bebe2c231b503b661e06e3753f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign book titles, the sheer volume and the ML classifier's high confidence score suggest a malicious intent, possibly for SEO manipulation or to distribute further malware. The document body is heavily corrupted, preventing a detailed analysis of its content, but the presence of numerous links is the primary indicator of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9742

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seasasac.lflinkup.com/4da9da2da7da8da4/Getting-a-Grip-on-the-Basics-Building-a-Firm-Foundation-for-the-Victorious-Christian-Life-by-Beth-A-Jones.pdf
    • http://seasasac.lflinkup.com/6da0da2da8da0/The-Foundation-Novels-7-Book-Bundle-Foundation-Foundation-and-Empire-Second-Foundation-Foundation-s-Edge-Foundation-and-Earth-Prelude-to-Foundation-Forward-the-Foundation-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/4da3da4da3da0da2/How-Firm-a-Foundation-Safehold-5-by-David-Weber.pdf
    • http://seasasac.lflinkup.com/4da0da0da2da0da7/Right-from-Birth-Building-Your-Child-s-Foundation-for-Life--Birth-to-18-Months-by-Craig-T-Ramey.pdf
    • http://seasasac.lflinkup.com/1da1da5da3da7/His-Clockwork-Canary-The-Glorious-Victorious-Darcys-2-by-Beth-Ciotta.pdf
    • http://seasasac.lflinkup.com/2da6da6da5da7da3/His-Broken-Angel-The-Glorious-Victorious-Darcys-1-5-by-Beth-Ciotta.pdf
    • http://seasasac.lflinkup.com/2da9da2da9da9da4/Articles-on-Foundation-Universe-Books-Including-I-Robot-Foundation-s-Edge-the-Caves-of-Steel-Prelude-to-Foundation-Foundation-and-Earth-Foundation-Series-Isaac-Asimov-s-Robot-Series-Isaac-Asimov-s-Galactic-Empire-Series-by-Hephaestus-Books.pdf
    • http://seasasac.lflinkup.com/2da4da5da5da5da2/Sister-Christian-Genesis-Sister-Christian-1-by-Lisa-Beth-Darling.pdf
    • http://seasasac.lflinkup.com/8da4da6da9da3da2/Early-History-of-the-Christian-Church-From-its-Foundation-to-the-End-of-the-Fifth-Century-Volume-III-by-Louis-Duchesne.pdf
    • http://seasasac.lflinkup.com/2da5da7da7da2da8/Foundation-Foundation-and-Empire-Second-Foundation-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/7da0da8da8da2da5/The-Christian-Remembrancer-Or-Short-Reflections-Upon-the-Faith-Life-and-Conduct-of-a-Real-Christian-by-Ambrose-Serle.pdf
    • http://seasasac.lflinkup.com/7da0da8da8da7da0/The-Christian-Remembrancer-Or-Short-Reflections-Upon-the-Faith-Life-and-Conduct-of-a-Real-Christian-by-Ambrose-Serle.pdf
    • http://seasasac.lflinkup.com/1da5da9da9da7da3/Foundation-s-Triumph-Second-Foundation-Trilogy-3-by-David-Brin.pdf
    • http://seasasac.lflinkup.com/1da8da9da5da9/Ain-t-Gonna-Let-Nobody-Turn-Me-Around-Forty-Years-of-Movement-Building-with-Barbara-Smith-by-Alethia-Jones.pdf
    • http://seasasac.lflinkup.com/3da2da6da2da6da0/Foundation-and-Empire-Foundation-2-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/3da2da6da2da7da1/Foundation-s-Edge-Foundation-4-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/5da2da6da8da6da3/The-Foundation-Trilogy-Foundation-1-3-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/2da4da6da6da3/The-Foundation-Trilogy-Foundation-1-3-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/2da9da2da4da3da7/Prelude-to-Foundation-Foundation-1-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/1da0da5da3da0da0/Foundation-and-Earth-Foundation-5-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/4da0da0da2da0da7/Right-from-Birth-Building-

Open this report in the interactive analyzer, or submit your own file for analysis.