Malicious PDF — malware analysis report

Static analysis result for SHA-256 b51ef1ef7b01de18…

MALICIOUS

PDF

15.7 KB Created: 2019-04-30 04:57:33 +01:00 Authoring application: mPDF 5.7 First seen: 2021-08-20
MD5: d771e8b824e78af73c4f4797838a8303 SHA-1: 91e3447136cacfda0babc2e4a9c25ba40d6fc5d4 SHA-256: b51ef1ef7b01de180cbb1acc1bdcf0db440d544be944a4f49a9a76b5ce7f3e73
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, identified as a link farm. While the ML classifier flagged it as malicious with high confidence, the specific intent beyond link farming is unclear. The presence of a 'download button' heuristic suggests a potential lure, but no scripts were extracted to confirm payload delivery or further malicious actions.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9778

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/9a07a09a01a09a05/Is-a-Camel-a-Mammal-by-Tish-Rabe.pdf In PDF document text
    • http://muicuiu.dumb1.com/2a04a09a03a08a07/Born-to-Run-by-Tish-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a07a09a01a09a01/On-Beyond-Bugs-by-Tish-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a07a09a01a03a07/Oh-Baby-the-Places-You-ll-Go-by-Tish-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/3a00a05a00a02a03/Huff-and-Puff-NookBook-by-Tish-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a07a09a03a06a04/Huff-and-Puff-Have-Too-Much-Stuff-by-Tish-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a07a09a02a09a00/A-Tale-about-Tails-Dr-Seuss-The-Cat-in-the-Hat-Knows-a-Lot-about-That-by-Tish-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a07a09a03a07a03/The-Thinga-ma-jigger-is-Coming-Today-by-Tish-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a07a09a02a01a07/Why-Oh-Why-are-Deserts-Dry-All-About-Deserts-by-Tish-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a01a03a09a06a07a09/I-Mammal-Why-Your-Brain-Links-Status-and-Happiness-by-Loretta-Graziano-Breuning.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a01a01a04a00a01a04/Marine-Mammal-Observer-and-Passive-Acoustic-Monitoring-Handbook-by-Victoria-Todd.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a03a09a00a06a02/The-Hedgehog-s-Dilemma-A-Tale-of-Obsession-Nostalgia-and-the-World-s-Most-Charming-Mammal-by-Hugh-Warwick.pdfIn PDF document text
    • http://muicuiu.dumb1.com/4a00a03a01a02a02/Prophecy-s-Child-Ovialell-0-5-by-Tish-Thawer.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a07a09a03a07a01/Be-My-Valentine-by-Sheila-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/3a03a03a03a07a08/A-Hero-by-Any-Other-Name-by-Jean-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/6a02a09a01a05/Chasing-the-Rainbow-Facilitating-a-Pagan-Festival-by-Tish-Owen.pdfIn PDF document text
    • http://muicuiu.dumb1.com/4a02a05a07a01a04/Bert-amp-the-Broken-Teapot-Growing-Up-Book-by-Tish-Sommers.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a01a00a03a01a07a06/Clarence-the-Camel-by-Ken-Lake.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a04a07a07a01/Pockets-of-Darkness-by-Jean-Rabe.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a03a09a07a03a05/Sticks-and-Bones-by-David-Rabe.pdfIn PDF document text