Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf0862d77e9a0840…

MALICIOUS

PDF

22.7 KB Created: 2019-05-02 18:35:15 +01:00 Authoring application: mPDF 5.7
MD5: ec25c5de79ed8e69d5b1f9d5f48e2a45 SHA-1: e7ab433ac2d18865bd9e2c1da71cffb5135548d8 SHA-256: bf0862d77e9a0840c19de800c5ee76ad1c9304456fee984060c70b97f0580b71
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection mechanism. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. The embedded URLs, such as http://kiteeearpdf.myhome.cx/8f210f215f216f210f211/A-Discourse-on-Domination-in-Mandate-Palestine-Imperialism-Property-and-Insurgency-by-Zeina-B-Ghandour.pdf, are likely used to direct users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9903

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/8f210f215f216f210f211/A-Discourse-on-Domination-in-Mandate-Palestine-Imperialism-Property-and-Insurgency-by-Zeina-B-Ghandour.pdf
    • http://kiteeearpdf.myhome.cx/8f210f215f216f210f212/A-Discourse-on-Domination-in-Mandate-Palestine-Imperialism-Property-and-Insurgency-by-Talitha-Ghandour-Zeina.pdf
    • http://kiteeearpdf.myhome.cx/1f211f211f218f210f219f214/Insurgency-and-Counter-Insurgency-in-Iraq-by-Ahmed-S-Hashim.pdf
    • http://kiteeearpdf.myhome.cx/8f218f216f218f216f212/Property-Place-and-Piracy-Routledge-Complex-Real-Property-Rights-Series-by-Martin-Fredriksson.pdf
    • http://kiteeearpdf.myhome.cx/2f217f213f216f214f212/The-Social-Contract-a-Discourse-on-the-Origin-of-Inequality-and-a-Discourse-on-Political-Economy-by-Jean-Jacques-Rousseau.pdf
    • http://kiteeearpdf.myhome.cx/8f219f219f217f215f215/Greek-in-Jewish-Palestine-Hellenism-in-Jewish-Palestine-by-Saul-Lieberman.pdf
    • http://kiteeearpdf.myhome.cx/1f211f216f218f216f212f218/Intellectual-property-navigating-through-commercial-waters-issues-and-solutions-when-negotiating-intellectual-property-with-commercial-companies-by-Defence-Science-Board.pdf
    • http://kiteeearpdf.myhome.cx/4f216f219f214f210f210/Mandate-Will-of-the-People-by-Vir-Sanghvi.pdf
    • http://kiteeearpdf.myhome.cx/2f214f216f214f212f215/Insurgency-by-Kurt-Schuett.pdf
    • http://kiteeearpdf.myhome.cx/3f219f215f211f218f211/The-Valkyrie-Mandate-The-Book-That-Changed-History-by-Robert-Vaughan.pdf
    • http://kiteeearpdf.myhome.cx/4f218f214f211f217/Culture-and-Imperialism-by-Edward-W-Said.pdf
    • http://kiteeearpdf.myhome.cx/7f219f212f213f218f216/Imperialism-and-Unequal-Development-by-Samir-Amin.pdf
    • http://kiteeearpdf.myhome.cx/9f216f212f215f216f211/Burma-in-Revolt-Opium-and-Insurgency-Since-1948-by-Bertil-Lintner.pdf
    • http://kiteeearpdf.myhome.cx/6f214f217f211f217f212/Capitalist-Rising-The-Short-History-of-a-Long-Insurgency-by-A-J-Poitras.pdf
    • http://kiteeearpdf.myhome.cx/3f218f215f213f211f215/Boko-Haram-Nigeria-s-Islamist-Insurgency-by-Virginia-Comolli.pdf
    • http://kiteeearpdf.myhome.cx/5f216f214f215f218f215/The-Absent-State-Insurgency-as-an-Excuse-for-Misgovernance-by-Neelesh-Misra.pdf
    • http://kiteeearpdf.myhome.cx/3f216f219f215f216f211/The-Lost-Mandate-of-Heaven-The-American-Betrayal-of-Ngo-Dinh-Diem-President-of-Vietnam-by-Geoffrey-Shaw.pdf
    • http://kiteeearpdf.myhome.cx/1f210f219f215f215f217f215/Birthrate-Politics-in-Zion-Judaism-Nationalism-and-Modernity-Under-the-British-Mandate-by-Lilach-Rosenberg-Friedman.pdf
    • http://kiteeearpdf.myhome.cx/6f216f210f211f213f210/Power-Energy-and-the-New-Russian-Imperialism-by-Anita-Orban.pdf
    • http://kiteeearpdf.myhome.cx/9f210f211f210f212f214/Overseas-Investment-in-the-Age-of-High-Imperialism-by-Michael-Edelstein.pdf
    • http://kiteeearpdf.myhome.cx/

Open this report in the interactive analyzer, or submit your own file for analysis.