Malicious PDF — malware analysis report

Static analysis result for SHA-256 c359b73e104f7478…

MALICIOUS

PDF

17.9 KB Created: 2019-04-30 02:48:15 +01:00 Authoring application: mPDF 5.7
MD5: 0a65d2bd6c4b3330cc280fca9444e9b0 SHA-1: 879f08c076575cabe13c5f9fcad3b81f84fa7734 SHA-256: c359b73e104f74782e3a3293505e8a0e9f3ae743ad0eb9a15c500d9bc351c693
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO poisoning or to distribute further malicious content. The ML classifier strongly indicated maliciousness. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the immediate user-facing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9807

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a05a01a03a03a04/Cover-Her-Face-Adam-Dalgliesh-1-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/3a03a06a03a03a03/Cover-Her-Face-Adam-Dalgliesh-1-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/1a09a01a04a03a01/A-Certain-Justice-Adam-Dalgliesh-10-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/3a04a02a05a08a02/The-Lighthouse-Adam-Dalgliesh-13-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/2a02a05a03a07a06/Unnatural-Causes-Adam-Dalgliesh-3-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/1a07a04a06a06/Shroud-for-a-Nightingale-Adam-Dalgliesh-4-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/1a08a06a06a02a07/The-Private-Patient-Adam-Dalgliesh-14-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/5a03a02a00a03/Death-in-Holy-Orders-Adam-Dalgliesh-11-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/6a00a06a01a03a06/Cover-Her-Face-BBC-Radio-4-Full-cast-Dramatisation-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/1a00a06a04a03a03a05/A-Different-Shade-of-Blue-How-women-changed-the-face-of-police-work-by-Adam-Eisenberg.pdf
    • http://muicuiu.dumb1.com/5a00a04a02a00a05/From-Cover-to-Cover-Evaluating-and-Reviewing-Children-s-Books-by-Kathleen-T-Horning.pdf
    • http://muicuiu.dumb1.com/9a07a09a09a01/Cover-to-Cover-Through-the-Bible-in-365-Days-by-John-A-Carroll.pdf
    • http://muicuiu.dumb1.com/1a03a02a05a03a08/Climate-Cover-Up-The-Crusade-to-Deny-Global-Warming-by-James-Hoggan.pdf
    • http://muicuiu.dumb1.com/4a03a04a00a09a00/The-Cover-Series-Box-Set-Cover-1-3-by-Kim-Black.pdf
    • http://muicuiu.dumb1.com/1a00a06a00a08a05a00/North-Face-of-Soho-by-Clive-James.pdf
    • http://muicuiu.dumb1.com/4a07a09a08a02a08/GEDLA-ADAM-The-Combat-of-Adam-Against-Satan-The-Book-of-Adam-amp-Eve-by-Ethiopian-Church.pdf
    • http://muicuiu.dumb1.com/2a06a02a00a04a01/The-Vanishing-Face-of-Gaia-A-Final-Warning-by-James-E-Lovelock.pdf
    • http://muicuiu.dumb1.com/1a04a01a04a02a08/Unmaking-Goliath-Community-Control-in-the-Face-of-Global-Capital-by-James-DeFilippis.pdf
    • http://muicuiu.dumb1.com/9a02a07a06a07a07/Face-To-Face-Encounters-Between-Jews-amp-Blacks-Photographs-And-Text-by-Laurence-Salzmann.pdf
    • http://muicuiu.dumb1.com/7a04a07a04a01a05/Interaction-Ritual---Essays-on-Face-to-Face-Behavior-by-Erving-Goffman.pdf
    • http://muicuiu.dumb1.com/1a00a06a04a03a03a05/A-Different-Shade-of-Blue-How-

Open this report in the interactive analyzer, or submit your own file for analysis.