Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2bcdc557f80aeb6…

MALICIOUS

PDF

12.8 KB Created: 2019-05-07 05:51:28 +01:00 Authoring application: mPDF 5.7
MD5: 9f1fe1ef21c3f36b0027fd6129822aa0 SHA-1: 47ccf0b88c03140660a348a4108e94f684b58f83 SHA-256: b2bcdc557f80aeb6aba29f687a5a58ac7bbde47f0e4107ea8c70732709664db6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While most of these URLs are marked as benign, the sheer volume and the ML classifier's high confidence score suggest a malicious intent, likely for SEO manipulation or to distribute further malicious content. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8905

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/5209201208203/Fifty-Seven-Reasons-Not-to-Have-a-Nuclear-War-by-Marty-Asher.pdf
    • http://xiixmcuin.linkpc.net/1201204206209202208/Asher-s-Invention-Asher-Quigley-1-by-Coleen-Kwan.pdf
    • http://xiixmcuin.linkpc.net/3208209204208202/Asher-s-War-Asher-Benson-3-by-Jason-Brant.pdf
    • http://xiixmcuin.linkpc.net/1209205205206209/Asher-s-Out-The-Asher-Trilogy-3-by-Elizabeth-Wheeler.pdf
    • http://xiixmcuin.linkpc.net/1201204207200207208/Asher-And-The-Threesome-Asher-2-by-Zoe-Nichols.pdf
    • http://xiixmcuin.linkpc.net/9207204201203/So-Many-Reasons-Why-So-Many-Reasons-1-by-Missy-Johnson.pdf
    • http://xiixmcuin.linkpc.net/9202202200204208/1000-Reasons-to-Be-Happy-1000-Reasons-by-David-Baird.pdf
    • http://xiixmcuin.linkpc.net/4207202206205/The-Thirteen-Hallows-Thirteen-Hallows-1-by-Michael-Scott.pdf
    • http://xiixmcuin.linkpc.net/4207202205203208/Mr-8-by-David-J-Thirteen.pdf
    • http://xiixmcuin.linkpc.net/4205209209202209/The-Future-of-Us-by-Jay-Asher.pdf
    • http://xiixmcuin.linkpc.net/3200206201207207/The-Thirteen-by-Susie-Moloney.pdf
    • http://xiixmcuin.linkpc.net/4209209201200206/Thirteen-by-Candice-Ransom.pdf
    • http://xiixmcuin.linkpc.net/8204206202204/The-Thirteen-by-James-Patterson.pdf
    • http://xiixmcuin.linkpc.net/3208203206202207/The-Question-by-Jane-Asher.pdf
    • http://xiixmcuin.linkpc.net/6201200205204203/The-Parasite-by-Neal-L-Asher.pdf
    • http://xiixmcuin.linkpc.net/1205204201206206/My-Name-Is-Asher-Lev-by-Chaim-Potok.pdf
    • http://xiixmcuin.linkpc.net/1200208200201207/Thirteen-for-Dinner-by-Denise-Daisy.pdf
    • http://xiixmcuin.linkpc.net/7206205206207206/The-Thirteen-Ghosts-by-Geronimo-Stilton.pdf
    • http://xiixmcuin.linkpc.net/2207202207203200/Thirteen-Moons-by-Charles-Frazier.pdf
    • http://xiixmcuin.linkpc.net/5202209206205209/Thirteen-Monologues-by-Jean-Cocteau.pdf
    • http://xiixmcuin.linkpc.net/4209209201200206/Thirteen-by-Candice-Ran

Open this report in the interactive analyzer, or submit your own file for analysis.