Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2f28b65d1479e54…

MALICIOUS

PDF

15.1 KB Created: 2020-03-18 21:11:08 +00:00 Authoring application: mPDF 5.7
MD5: adaeac3f3c191b30ddb561bd63667b4d SHA-1: 2155e0fec1e1c2eea655677b4cf94e1433b3e634 SHA-256: c2f28b65d1479e5480dc3895173b304f0b4de2b17ffb197c2b0d916e85bfbbb0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on the domain easckaolp.myhome.cx. This is indicative of a link farm or a distribution point for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://easckaolp.myhome.cx/7844848843848848/LA-DERNI-RE-BALLE-by-J-M-Gallego.pdf
    • http://easckaolp.myhome.cx/9846847847843841/Omnia-by-Laura-Gallego-Garc-a.pdf
    • http://easckaolp.myhome.cx/1840847848840841845/Wander-Reiten-um-die-Welt-Oskar-reitet-in-Indien-Tibet-China-T-rkei-Nord-und-S-damerika-by-Manuel-Sauda-Sauda-Manuel.pdf
    • http://easckaolp.myhome.cx/9846847845844840/Conversations-with-Manuel-Castells-by-Manuel-Castells.pdf
    • http://easckaolp.myhome.cx/1841843847848843849/Die-Totenfresser-by-Niklaus-Manuel.pdf
    • http://easckaolp.myhome.cx/3843849843845848/Kanyakumari-by-Hazel-Manuel.pdf
    • http://easckaolp.myhome.cx/5844841844841848/Chaos-by-Manuel-Almendro.pdf
    • http://easckaolp.myhome.cx/9846847847842846/Manuel-Castells-by-Frank-Webster.pdf
    • http://easckaolp.myhome.cx/4845848847849/Four-Spanish-Pieces-by-Manuel-de-Falla.pdf
    • http://easckaolp.myhome.cx/3846846840846846/The-Geranium-Woman-by-Hazel-Manuel.pdf
    • http://easckaolp.myhome.cx/1841840847841848846/The-Man-of-My-Life-by-Manuel-V-zquez-Montalb-n.pdf
    • http://easckaolp.myhome.cx/1848846846842842/Insecten-in-plastic-by-Manuel-van-Loggem.pdf
    • http://easckaolp.myhome.cx/6848841844845842/Zigzagger-Stories-by-Manuel-Mu-oz.pdf
    • http://easckaolp.myhome.cx/4849842843843847/The-Carpenter-s-Pencil-by-Manuel-Rivas.pdf
    • http://easckaolp.myhome.cx/3844849843843843/The-Killer-Trees-by-David-E-Manuel.pdf
    • http://easckaolp.myhome.cx/9844849847843846/Als-ik-nee-zeg-voel-ik-me-schuldig-by-Manuel-J-Smith.pdf
    • http://easckaolp.myhome.cx/3846841841848841/Tattoo-by-Manuel-V-zquez-Montalb-n.pdf
    • http://easckaolp.myhome.cx/9846847847842845/Manuel-Castells-by-Jesse-Russell.pdf
    • http://easckaolp.myhome.cx/5840849846844841/-Qu-me-quieres-amor-by-Manuel-Rivas.pdf
    • http://easckaolp.myhome.cx/6842841844849840/So-ador-by-Manuel-Angel-Arrias.pdf
    • http://easckaolp.myhome.cx/1841840847841848846/The-Man-of-My-Life-by-Manuel-V-

Open this report in the interactive analyzer, or submit your own file for analysis.