Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0c966bdfae473a4…

MALICIOUS

PDF

19.5 KB Created: 2020-03-18 17:38:41 +00:00 Authoring application: mPDF 5.7
MD5: 7ef917c7cae72dc3eb63783ec4d270d9 SHA-1: 4f5a5e2294a2f39c8a692c519b38919638629f08 SHA-256: b0c966bdfae473a441605e0fa83d3b2e6e3fc58d559140560588b9d16d2b907f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to other PDF files, characteristic of a link farm or SEO poisoning attack. The ML classifier strongly indicated maliciousness. The embedded URLs are likely intended to redirect users to malicious content or facilitate further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tanceubio.myhome.cx/83d03d63d63d5/Star-Wars-Darth-Plagueis-by-James-Luceno.pdf
    • http://tanceubio.myhome.cx/33d03d23d13d6/Darth-Plagueis-by-James-Luceno.pdf
    • http://tanceubio.myhome.cx/53d53d83d73d63d4/Le-Labyrinthe-du-mal-Star-Wars-The-Dark-Lord-Trilogy-1-by-James-Luceno.pdf
    • http://tanceubio.myhome.cx/33d33d93d73d13d9/Hero-s-Trial-Star-Wars-The-New-Jedi-Order-4-by-James-Luceno.pdf
    • http://tanceubio.myhome.cx/43d43d93d13d0/Labyrinth-of-Evil-Star-Wars-The-Dark-Lord-Trilogy-1-by-James-Luceno.pdf
    • http://tanceubio.myhome.cx/33d03d53d03d63d5/Star-Wars-Darth-Maul-by-Ron-Marz.pdf
    • http://tanceubio.myhome.cx/33d73d13d33d9/Dynasty-of-Evil-Star-Wars-Darth-Bane-3-by-Drew-Karpyshyn.pdf
    • http://tanceubio.myhome.cx/33d43d03d03d93d1/Star-Wars-Darth-Vader-Vol-1-Imperial-Machine-Dark-Lord-of-the-Sith-1-by-Charles-Soule.pdf
    • http://tanceubio.myhome.cx/33d33d93d33d33d6/The-Visual-Dictionary-of-Star-Wars-Episodes-IV-V-amp-VI-The-Ultimate-Guide-to-Star-Wars-Characters-and-Creatures-by-David-West-Reynolds.pdf
    • http://tanceubio.myhome.cx/63d63d13d63d63d5/Star-Wars-Chevaliers-de-l-ancienne-r-publique-T02-Ultime-recours-Star-Wars-Knights-of-the-Old-Republic-2-by-John-Jackson-Miller.pdf
    • http://tanceubio.myhome.cx/43d53d53d43d63d0/The-Star-Wars-Trilogy-Star-Wars-The-Empire-Strikes-Back-Return-of-the-Jedi-by-George-Lucas.pdf
    • http://tanceubio.myhome.cx/33d33d93d73d33d9/Star-Wars-Vol-3-Rebel-Jail-Star-Wars-3-by-Jason-Aaron.pdf
    • http://tanceubio.myhome.cx/33d33d93d73d43d2/Star-Wars-Vol-4-Last-Flight-of-the-Harbinger-Star-Wars-4-by-Jason-Aaron.pdf
    • http://tanceubio.myhome.cx/33d03d53d73d73d6/Return-of-the-Jedi-Star-Wars-Novelizations-6-by-James-Kahn.pdf
    • http://tanceubio.myhome.cx/83d73d13d53d03d4/Star-Wars-Spezies-Star-Wars-Geschichten-aus-einer-weit-weit-entfernten-Galaxis-by-Landry-Q-Walker.pdf
    • http://tanceubio.myhome.cx/33d43d03d03d93d3/Star-Wars-Vol-6-Out-Among-the-Stars-Star-Wars-6-by-Jason-Aaron.pdf
    • http://tanceubio.myhome.cx/83d93d83d73d23d4/Star-Wars-Vor-dem-Erwachen-Die-offizielle-Vorgeschichte-zu-Star-Wars-Das-Erwachen-der-Macht-by-Greg-Rucka.pdf
    • http://tanceubio.myhome.cx/73d43d93d33d43d4/Star-Wars-Choose-Your-Destiny-Book-1-A-Han-amp-Chewie-Adventure-Star-Wars-Choose-Your-Destiny-by-Elsa-Charretier.pdf
    • http://tanceubio.myhome.cx/33d33d93d13d23d0/Millennium-Falcon-by-James-Luceno.pdf
    • http://tanceubio.myhome.cx/53d83d83d33d63d7/Star-Wars-Clone-Wars-Volume-3-Last-Stand-on-Jabim-by-W-Haden-Blackman.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.