Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1620209e65d2663…

MALICIOUS

PDF

16.1 KB Created: 2019-04-30 04:21:45 +01:00 Authoring application: mPDF 5.7
MD5: 02333823a4747e3e3f49b99a91f7f794 SHA-1: 5323d7bffa233eff8fa9cdc6d1e91d20892d3222 SHA-256: b1620209e65d2663a73f3a5d55615b4fc4b44430629ca66af24d749705c017fa
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified as a link farm. The ML classifier strongly indicates maliciousness. While no scripts were extracted, the sheer volume of links suggests a malicious intent, possibly to redirect users to phishing sites or to manipulate search engine results. The primary IOCs are the numerous external URLs found within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/3a08a03a07a08a02/Venus-Laid-Bare-St-John-Duras-5-by-Susan-Johnson.pdf
    • http://muicuiu.dumb1.com/3a08a03a04a08a04/Sinful-St-John-Duras-1-by-Susan-Johnson.pdf
    • http://muicuiu.dumb1.com/3a08a03a09a06a07/Touch-of-Sin-St-John-Duras-4-by-Susan-Johnson.pdf
    • http://muicuiu.dumb1.com/5a09a07a06a04/Sinful-Dreams-St-John-Duras-1-by-Susan-Johnson.pdf
    • http://muicuiu.dumb1.com/3a00a00a05a08a09/Wicked-Fascination-St-John-Duras-2-by-Susan-Johnson.pdf
    • http://muicuiu.dumb1.com/4a01a07a00a01a02/Exposed-Laid-Bare-Laid-Bare-1-by-S-R-Grey.pdf
    • http://muicuiu.dumb1.com/7a00a05a07a07a05/Laid-Bare-by-Cerise-DeLand.pdf
    • http://muicuiu.dumb1.com/8a06a08a08a07/American-Rose-A-Nation-Laid-Bare-The-Life-and-Times-of-Gypsy-Rose-Lee-by-Karen-Abbott.pdf
    • http://muicuiu.dumb1.com/1a00a05a09a05a04a02/Cross-To-Bare-Men-of-London-5-by-Susan-Mac-Nicol.pdf
    • http://muicuiu.dumb1.com/1a06a05a08a05a04/The-Bare-Melcessities-Walking-Out-Waking-Up-Getting-Bare-by-Melanie-Lutz.pdf
    • http://muicuiu.dumb1.com/2a05a03a01a09a05/Stripped-Bare-Bare-Love-7-by-Lacey-Thorn.pdf
    • http://muicuiu.dumb1.com/3a03a03a07a08/Men-Are-from-Mars-Women-Are-from-Venus-by-John-Gray.pdf
    • http://muicuiu.dumb1.com/7a01a04a01a09a01/Why-Mars-and-Venus-Collide-by-John-Gray.pdf
    • http://muicuiu.dumb1.com/7a01a04a02a04a01/Venus-Aspiring-Venus-Rising-2-by-Golden-Angel.pdf
    • http://muicuiu.dumb1.com/7a01a04a01a03a04/The-Wizard-of-Venus-Venus-5-by-Edgar-Rice-Burroughs.pdf
    • http://muicuiu.dumb1.com/7a01a04a01a03a03/Escape-on-Venus-Venus-4-by-Edgar-Rice-Burroughs.pdf
    • http://muicuiu.dumb1.com/2a09a06a08a09a02/Hot-Pink-by-Susan-Johnson.pdf
    • http://muicuiu.dumb1.com/3a08a03a04a08a07/Pure-Sin-by-Susan-Johnson.pdf
    • http://muicuiu.dumb1.com/2a06a08a03a01a02/The-Bare-Bones-The-Bare-Bones-MC-1-by-Layla-Wolfe.pdf
    • http://muicuiu.dumb1.com/2a07a03a04a03a08/The-Infernals-A-Samuel-Johnson-Tale-Samuel-Johnson-vs-the-Devil-2-by-John-Connolly.pdf
    • http://muicuiu.dumb1.com/2a05a03a01a09a05/Stripped-Bare-Bare-Love-7-by-Lacey-Thorn

Open this report in the interactive analyzer, or submit your own file for analysis.