Malicious PDF — malware analysis report

Static analysis result for SHA-256 c04313e86750c278…

MALICIOUS

PDF

20.3 KB Created: 2019-04-30 03:49:57 +01:00 Authoring application: mPDF 5.7
MD5: e8706f6e44ec69e1169b93b2b1c712fa SHA-1: 23be72c0d7362d1491f74093523d5233b969f9c3 SHA-256: c04313e86750c278bfa9f999e8765203a2b575a7130ce015f309439dc461131f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While most of these URLs themselves are classified as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to serve as a landing page for further malicious activity. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted from this sample, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/3a01a00a07a06a02/A-Passion-for-My-Provence-Home-Cooking-from-the-South-of-France-by-Lydie-Marshall.pdf
    • http://muicuiu.dumb1.com/8a02a04a09a00a04/The-Cooking-of-Southwest-France-Recipes-from-France-s-Magnificient-Rustic-Cuisine-by-Paula-Wolfert.pdf
    • http://muicuiu.dumb1.com/7a00a02a07a01a06/Contemporary-Living-in-Provence-amp-Cote-D-Azur-Demeures-Contemporaines-En-Provence-amp-Cote-D-Azur-Hedendaags-Wonen-in-Provence-amp-Cote-D-Azur-by-Wim-Pauwels.pdf
    • http://muicuiu.dumb1.com/4a03a08a09a00a09/Travels-in-the-South-of-France-by-Stendhal.pdf
    • http://muicuiu.dumb1.com/6a01a08a08a07a05/Proven-al-Cooking-Savoring-the-Simple-Life-in-France-by-Mary-Ann-Caws.pdf
    • http://muicuiu.dumb1.com/3a00a09a06a09a07/Quiches-Kugels-and-Couscous-My-Search-for-Jewish-Cooking-in-France-by-Joan-Nathan.pdf
    • http://muicuiu.dumb1.com/7a09a04a05a07a02/South-of-France-French-Entree-10-by-Patricia-Fenn.pdf
    • http://muicuiu.dumb1.com/2a00a08a02a04a03/Cooking-in-Other-Women-s-Kitchens-Domestic-Workers-in-the-South-1865-1960-by-Rebecca-Sharpless.pdf
    • http://muicuiu.dumb1.com/4a07a01a06a07a09/Cooking-in-Other-Women-s-Kitchens-Domestic-Workers-in-the-South-1865-1960-by-Rebecca-Sharpless.pdf
    • http://muicuiu.dumb1.com/1a09a00a07/Home-is-Burning-by-Dan-Marshall.pdf
    • http://muicuiu.dumb1.com/7a01a04a09a03a01/Lagrasse-and-the-Corbi-res-Life-in-the-deep-south-of-France-by-Stuart-Benton.pdf
    • http://muicuiu.dumb1.com/1a04a01a03a00a08/Words-in-a-French-Life-Lessons-in-Love-and-Language-from-the-South-of-France-by-Kristin-Espinasse.pdf
    • http://muicuiu.dumb1.com/1a01a07a07a07a07a01/Vietnamese-Home-Cooking-by-Charles-Phan.pdf
    • http://muicuiu.dumb1.com/3a00a09a06a08a04/Down-home-cooking-by-Reader-39-s-Digest-Association.pdf
    • http://muicuiu.dumb1.com/1a09a04a00a04a06/Home-Cooking-A-Writer-in-the-Kitchen-by-Laurie-Colwin.pdf
    • http://muicuiu.dumb1.com/6a07a03a02a00a01/Season-with-Authority-Confident-Home-Cooking-by-Marc-Murphy.pdf
    • http://muicuiu.dumb1.com/5a03a00a07a01a08/Bonjour-Y-all-Heidi-s-Fusion-Cooking-on-the-South-Carolina-Coast-by-Heidi-Vukov.pdf
    • http://muicuiu.dumb1.com/3a01a01a01a02a05/Taste-amp-Technique-Recipes-to-Elevate-Your-Home-Cooking-by-Naomi-Pomeroy.pdf
    • http://muicuiu.dumb1.com/2a03a06a04a02a07/Just-South-of-Home-by-Karen-Strong.pdf
    • http://muicuiu.dumb1.com/4a06a00a00a07a07/Global-Home-Cooking-International-Families-Favorite-Recipes-by-Nancy-Freund.pdf
    • http://muicuiu.dumb1.com/4a03a08a09a00a09/Travels-

Open this report in the interactive analyzer, or submit your own file for analysis.