Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfbc926909081339…

MALICIOUS

PDF

23.4 KB Created: 2019-04-30 06:14:46 +01:00 Authoring application: mPDF 5.7
MD5: 5850134756c982958ff2239ee443a477 SHA-1: caedc321f28d595c210270cae9de71bfd59be3c8 SHA-256: bfbc926909081339629155fd7ee3789f5bafc372428299fb8bd1c2d79938a71b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various PDF documents, suggesting a link farm or content hosting strategy. While the document body is heavily obfuscated, the presence of numerous external links indicates a potential attempt to direct users to malicious or misleading content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9726

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seasasac.lflinkup.com/1da1da8da9da9da1da4/The-Small-House-at-Allington-by-Anthony-Trollope-Complete-Volume-1-and-2-Illustrated-Sir-John-Everett-Millais-1st-Baronet-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/1da1da8da9da9da0da9/Phineas-Finn-the-Irish-Member-a-Novel-by-Anthony-Trollope-in-Two-Volume-Illustrated-by-Sir-John-Everett-Millais-1st-Baronet-Pra-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/1da1da8da9da9da3da1/Framley-Parsonage-1871-by-Anthony-Trollope-Illustrated-By-John-Everett-Millais-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-Framley-Parsonage-Is-the-Fourth-Novel-in-Anthony-Trollope-s-Series-Known-as-the-Chronicles-of-B-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/4da8da4da3da9da2/Rachel-Ray-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/4da6da6da8da8da6/The-Way-We-Live-Now-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/2da0da2da3da1da7/He-Knew-He-Was-Right-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/4da2da8da8da0da8/The-Way-We-Live-Now-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/1da7da4da1da4da5/The-Way-We-Live-Now-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/8da1da9da1da1da6/The-Life-Of-Cicero-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/5da3da5da7da4/Can-You-Forgive-Her-Palliser-1-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/1da8da6da4da9da0/Miss-Mackenzie-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/2da2da2da3da0da7/The-Prime-Minister-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/2da2da3da4da5da0/Barchester-Towers-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/2da4da1da3da4da0/Ayala-s-Angel-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/9da5da8da3da9da4/Das-Pfarrhaus-Framley-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/2da2da2da1da4da2/The-American-Senator-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/4da4da1da1da0da3/Castle-Richmond-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/1da6da6da9da1da1/Dr-Wortle-s-School-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/6da2da4da9da9da0/The-Chateau-Of-Prince-Polignac-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/4da8da0da2da5/Dr-Thorne-Chronicles-of-Barsetshire-3-by-Anthony-Trollope.pdf
    • http://seasasac.lflinkup.com/1da1da8da9da9da3da1/Framley-Parsonage-1871-by-Anthony-Trollope-Illustrated-By-John-Everett-Millais-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-Framley-Parsonage-Is-the-Fourth-Novel-in-Anthony-Trollope-s-Series-Known-as-the-Chronicles-of-B-by-Anthony-Tro