Malicious PDF — malware analysis report

Static analysis result for SHA-256 b04cbec3e07649b3…

MALICIOUS

PDF

22.0 KB Created: 2020-03-18 21:32:30 +00:00 Authoring application: mPDF 5.7
MD5: afb25ccb7a465eff08e481824f62578a SHA-1: 438b1c34e7bd87613dd028213f596fa05dbf8b6f SHA-256: b04cbec3e07649b3fe07cf4d3ac088bf1ed46c7caf1abdd64c17cad632d0e76d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links to PDFs hosted on the domain 'rtuninnsi.myhome.cx', a common tactic for SEO poisoning or distributing malicious content. The ML classifier strongly indicated maliciousness. No scripts were extracted, but the PDF structure and link farm suggest a delivery mechanism for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9926

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rtuninnsi.myhome.cx/16a06a96a96a36a66a6/Alice-Im-Wunderland-Alice-in-Wonderland-German-Edition-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/96a06a16a26a96a1/Alice-im-Wunderland-Alice-in-Wonderland-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/16a16a86a86a06a76a8/Alice-hinter-den-Spiegeln-Alice-im-Wunderland-Briefe-an-kleine-M-dchen-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/36a46a36a36a0/Through-the-Looking-Glass-and-What-Alice-Found-There-Alice-s-Adventures-in-Wonderland-2-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/96a26a06a26a36a0/De-avonturen-van-Alice-in-Wonderland-amp-Achter-de-spiegel-en-wat-Alice-daar-aantrof-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/16a06a36a86a76a46a8/Alice-in-Wonderland-Through-the-Looking-Glass-What-Alice-Found-There-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/16a16a46a26a96a66a4/Alice-i-Spegellandet-Alice-s-Adventures-in-Wonderland-2-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/66a46a46a86a36a5/The-Nabokov-Russian-Translation-of-Lewis-Carroll-s-Alice-in-Wonderland-Anya-v-Stranye-Chudes-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/86a66a06a66a06a9/Alice-s-Adventures-in-Wonderland-Celebrating-Lewis-Carroll-s-North-East-Connections-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/76a06a46a36a96a1/Alice-in-Wonderland-And-Through-The-Looking-Glass-By-Lewis-Carroll---Illustrated-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/16a06a06a46a26a36a8/Alice-in-Wonderland-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/16a16a06a56a46a86a8/Alice-in-Wonderland-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/36a36a16a26a16a0/Alice-in-Wonderland-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/96a96a26a66a56a5/Alice-in-Wonderland-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/36a46a26a16a96a5/Alice-s-Adventures-in-Wonderland-Alice-s-Adventures-in-Wonderland-1-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/56a26a16a86a1/Alice-s-Adventures-in-Wonderland-Alice-s-Adventures-in-Wonderland-1-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/26a16a56a46a26a1/Alice-in-Wonderland-amp-Through-the-Looking-Glass-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/96a26a76a96a56a8/Alice-s-Adventures-in-Wonderland-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/46a76a06a36a06a7/Alice-s-Adventures-In-Wonderland-by-Lewis-Carroll.pdf
    • http://rtuninnsi.myhome.cx/56a56a36a46a86a8/Alice-in-Wonderland-and-Through-the-Looking-Glass-by-Lewis-Carroll.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.