Malicious PDF — malware analysis report

Static analysis result for SHA-256 b156ba2793136701…

MALICIOUS

PDF

20.7 KB Created: 2019-04-30 05:16:17 +01:00 Authoring application: mPDF 5.7
MD5: ee026132b15738793e74f289fcaab52d SHA-1: cf80194e61be8209f2f3671b2c0275260c53eead SHA-256: b156ba2793136701bfd031dcb577b0036c31cb0820ad423f654586863f468e68
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to what appear to be book titles, but are likely part of a link farm or redirection scheme. The ML_NYX_PDF_MALICIOUS classifier also flagged this document with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9924

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1
    • http://muicuiu.dumb1.com/6a04a04a04a07a08/Encyclopedia-Brown-and-the-Case-of-the-Secret-UFOs-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a07a05a05a04a05/Encyclopedia-Brown-and-the-Case-of-the-Secret-Pitch-Encyclopedia-Brown-2-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a01a04a01a00a04a06/Encyclopedia-Brown-and-the-Case-of-the-Midnight-Visitor-Encyclopedia-Brown-13-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a01a04a01a00a09a04/Encyclopedia-Brown-and-the-Case-of-Pablo-s-Nose-Encyclopedia-Brown-20-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a01a04a01a00a08a06/Encyclopedia-Brown-and-the-Case-of-the-Mysterious-Handprints-Encyclopedia-Brown-16-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/6a04a04a03a06a09/Encyclopedia-Brown-Cracks-the-Case-Encyclopedia-Brown-24-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a01a04a01a00a09a01/Encyclopedia-Brown-Super-Sleuth-Encyclopedia-Brown-25-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a08a00a05a03a04/Encyclopedia-Brown-Takes-the-Cake-Encyclopedia-Brown-15-1-2-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a00a00a04a02a01a08/Encyclopedia-Brown-Sets-The-Pace-Encyclopedia-Brown-15-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a04a07a05a06a01/Encyclopedia-Brown-Keeps-the-Peace-Encyclopedia-Brown-6-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a01a04a01a00a04a04/Encyclopedia-Brown-Shows-the-Way-Encyclopedia-Brown-9-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a08a00a05a04a03/Encyclopedia-Brown-Tracks-Them-Down-Encyclopedia-Brown-8-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/6a04a04a02a08a07/Encyclopedia-Brown-Finds-the-Clues-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a01a04a01a00a04a02/Encyclopedia-Brown-Gets-His-Man-Encyclopedia-Brown-4-by-Donald-J-Sobol.pdf
    • http://muicuiu.dumb1.com/1a01a01a09a00a09a02/Encyclopedia-Of-Architectural-And-Engineering-Feats-by-Donald-Langmead.pdf
    • http://muicuiu.dumb1.com/9a09a04a00a07a02/Defending-Donald-Harvey-The-Case-of-America-s-Most-Notorious-Angel-of-Death-Serial-Killer-by-William-Whalen.pdf
    • http://muicuiu.dumb1.com/4a07a01a09a00a01/The-Secret-Keeper-Up-All-Night-The-Secret-Keeper-3-by-Brea-Brown.pdf
    • http://muicuiu.dumb1.com/8a09a02a08a08a06/The-Film-Encyclopedia-The-Most-Comprehensive-Encyclopedia-of-World-Cinema-in-a-Single-Volume-by-Ephraim-Katz.pdf
    • http://muicuiu.dumb1.com/4a00a01a06a09a07/The-Secret-of-Father-Brown-Father-Brown-4-by-G-K-Chesterton.pdf
    • http://muicuiu.dumb1.com/3a08a00a02a01a00/The-Secret-of-Hoke-Farm-by-Ashlen-Brown.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.