Malicious PDF — malware analysis report

Static analysis result for SHA-256 c40402cd5be0b3da…

MALICIOUS

PDF

19.0 KB Created: 2019-04-30 02:57:39 +01:00 Authoring application: mPDF 5.7
MD5: 25d29f50971a975cd9478f1e21ba6001 SHA-1: 8a90b4257788aed7ee81c434677496bda4ddc0a6 SHA-256: c40402cd5be0b3da0ee0e3b9d060d3e3909dc8a125b6848e5ea2a63e6794252a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm with 25 external links, all pointing to PDF documents. The ML classifier strongly indicated maliciousness. The primary attack pattern involves luring users to a large collection of external PDF files, likely for SEO poisoning or to host malicious content disguised as legitimate documents. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.d
    • http://muicuiu.dumb1.com/1a00a04a08a02a02a07/Choral-Concepts-A-Text-for-Conductors-by-Donald-Neuen.pdf
    • http://muicuiu.dumb1.com/9a05a08a04a02a01/Purchasing-and-Materials-Management-Text-and-Cases-by-Donald-W-Dobler.pdf
    • http://muicuiu.dumb1.com/1a00a04a08a02a08a04/Die-neuen-X-Men-Vol-1-Gestern-und-heute-Marvel-Now-Die-neuen-X-Men-by-Brian-Michael-Bendis.pdf
    • http://muicuiu.dumb1.com/4a04a06a04a07a06/Us-Conductors-by-Sean-Michaels.pdf
    • http://muicuiu.dumb1.com/8a02a01a02a09a08/Home-and-the-Heartland-From-Riverdance-Contemporary-Choral-Series-by-Bill-Whelan.pdf
    • http://muicuiu.dumb1.com/1a00a02a07a02a06a05/Alternative-Voices-Essays-on-Contemporary-Vocal-and-Choral-Composition-by-Istvan-Anhalt.pdf
    • http://muicuiu.dumb1.com/7a03a08a00a03a05/Conductors-of-the-Pit-Major-Works-by-Rimbaud-Vallejo-Cesaire-Artaud-and-Holan-by-Eshelma.pdf
    • http://muicuiu.dumb1.com/2a09a00a00a08a00/Don-t-Dream-The-Collected-Horror-and-Fantasy-Fiction-of-Donald-Wandrei-by-Donald-Wandrei.pdf
    • http://muicuiu.dumb1.com/9a04a02a03a09a08/The-Donald-Richie-Reader-50-Years-of-Writing-on-Japan-by-Donald-Richie.pdf
    • http://muicuiu.dumb1.com/2a02a07a06a09a07/President-Donald-Trump-Inaugural-Speech-by-Donald-J-Trump.pdf
    • http://muicuiu.dumb1.com/1a01a09a08a03a02a00/Die-Informationsgesellschaft-Im-Neuen-Jahrtausend-by-Arnulf-Baring.pdf
    • http://muicuiu.dumb1.com/1a01a09a07a07a04a00/Das-Harmoniegesetz-in-uns-Der-Klassiker-der-neuen-Richtungen-by-Max-L-scher.pdf
    • http://muicuiu.dumb1.com/1a00a01a00a06a03a04/Bitterfeld-In-Alten-Und-Neuen-Ansichten-by-Tatjana-Br-ckner.pdf
    • http://muicuiu.dumb1.com/1a00a03a07a05a08a05/Die-Entstehung-Der-Neuen-Frauenbewegung-in-Ostdeutschland-by-Anja-Benthin.pdf
    • http://muicuiu.dumb1.com/1a01a06a08a05a02a06/Die-Rolle-Des-Parlaments-in-Der-Neuen-Steuerung-by-Hermann-Hill.pdf
    • http://muicuiu.dumb1.com/1a01a07a06a07a01a08/Zuflucht-in-der-Neuen-Jugendherberge-by-Siegrid-Graunke-Gruel.pdf
    • http://muicuiu.dumb1.com/9a07a03a03a04a06/Der-Weg-In-Den-Neuen-Kalten-Krieg-by-Peter-Scholl-Latour.pdf
    • http://muicuiu.dumb1.com/5a09a04a07a03a03/Concepts-of-Physics-Part-1-by-H-C-Verma.pdf
    • http://muicuiu.dumb1.com/1a01a01a00a03a05a08/Concepts-for-Survival-by-Garn-Christensen.pdf
    • http://muicuiu.dumb1.com/5a09a04a07a03a02/Concepts-of-Physics-Part-2-by-H-C-Verma.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.