Malicious PDF — malware analysis report

Static analysis result for SHA-256 c08f7ec1af1b4bcd…

MALICIOUS

PDF

16.0 KB Created: 2019-05-01 20:06:17 +01:00 Authoring application: mPDF 5.7
MD5: 5b2712dc173f3aac5f17d3e1e1effe47 SHA-1: b22aa49722312061033c1c7e706865ee72d58cf9 SHA-256: c08f7ec1af1b4bcdbbe3ca42887c0524b324353bb5fb7247dfd93cb6bc996923
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, many of which are hosted on the dynamic DNS domain 'zacdsa.linkpc.net'. This behavior is indicative of a link farm or a redirection scheme designed to lead users to potentially malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zacdsa.linkpc.net/6c52c55c57c58c55/Gargantua-and-his-Son-Pantagruel-Five-Books-of-the-Lives-Heroic-Deeds-and-Sayings-of-Gargantua-and-his-Son-Pantagruel-by-Master-Francis-Rabelais.pdf
    • http://zacdsa.linkpc.net/6c50c50c50c59c57/Gargantua-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/4c54c58c50c56/Gargantua-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/8c57c57c53c56c51/Gargantua-and-Pantagruel-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/6c52c55c57c57c58/Gargantua-And-Pantagruel-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/8c54c52c56c54/Gargantua-and-Pantagruel-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/6c52c55c57c59c59/Gargantua-and-Pantagruel-Volume-1-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/5c58c55c54c54c54/Gargantua-und-Pantagruel-Vollst-ndige-Ausgabe-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/6c52c55c58c53c54/Gargantua-and-Pantagruel-Books-1-3-Tr-by-Urquhart-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/6c52c55c58c59c51/Fiche-de-lecture-Gargantua-de-Rabelais-by-Les-ditions-de-l-39-Ebook-malin.pdf
    • http://zacdsa.linkpc.net/6c50c55c52c55c51/Rabelais-and-Bakhtin-Popular-Culture-in-quot-Gargantua-and-Pantagruel-quot-by-Richard-M-Berrong.pdf
    • http://zacdsa.linkpc.net/6c50c55c50c59c56/The-Portable-Rabelais-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/6c50c55c52c52c52/The-Works-of-Rabelais-by-Fran-ois-Rabelais.pdf
    • http://zacdsa.linkpc.net/6c52c55c57c56c53/GARGANTUA-PANTAGRUEL-AU-GARGANTUA-PANTAGRUEL-AU-by-Cae-Swc1675.pdf
    • http://zacdsa.linkpc.net/2c53c54c58c55c59/The-Fran-Lebowitz-Reader-by-Fran-Lebowitz.pdf
    • http://zacdsa.linkpc.net/4c54c51c56c51c59/Madman-Gargantua-by-Mike-Allred.pdf
    • http://zacdsa.linkpc.net/6c52c55c58c50c53/Gargantua-and-His-Son-Pantagruel-by-Francois-Rabelias.pdf
    • http://zacdsa.linkpc.net/6c52c55c57c56c58/Polycentrism-and-Gargantua-by-Peter-J-Boettke.pdf
    • http://zacdsa.linkpc.net/6c52c55c58c50c58/The-Tale-of-Gargantua-and-King-Arthur-by-Francois-Girault.pdf
    • http://zacdsa.linkpc.net/6c52c55c58c50c55/The-Apex-Vision-of-Paracycloptik-Gargantua-by-Jamie-Sean-Lardner.pdf
    • http://zacdsa.linkpc.net/6c52c55c58c59c51/Fiche-de-lecture-Gargantua-de-Rabelais-by-Les-ditions-de-l-39-Ebook-malin.p

Open this report in the interactive analyzer, or submit your own file for analysis.