Malicious PDF — malware analysis report

Static analysis result for SHA-256 c52b7cd6e48f2171…

MALICIOUS

PDF

19.4 KB Created: 2020-03-17 03:25:13 +00:00 Authoring application: mPDF 5.7
MD5: b47a36b47428bad13e09c4a52d4ae605 SHA-1: 3b11124bbfefc445e96495fa8262831c5e0e77b2 SHA-256: c52b7cd6e48f21717b389cf4288f2c30ab8fe460fd57621c12570b2a46cbab84
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by an ML classifier and contains a large number of embedded external links, characteristic of a link farm. The document body, though partially corrupted, contains numerous URLs pointing to external PDF files. This suggests the primary purpose is to redirect users to a multitude of potentially malicious or deceptive websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://peldoaio.myhome.cx/53d03d23d93d43d0/Chronicle-of-the-Pharaohs-The-Reign-By-Reign-Record-of-the-Rulers-and-Dynasties-of-Ancient-Egypt-by-Peter-A-Clayton.pdf
    • http://peldoaio.myhome.cx/43d03d33d33d83d6/Chronicle-of-the-Roman-Emperors-The-Reign-by-Reign-Record-of-the-Rulers-of-Imperial-Rome-by-Christopher-Scarre.pdf
    • http://peldoaio.myhome.cx/13d13d33d43d53d83d8/Report-on-Egypt-1823-1838-Under-the-Reign-of-Mohamed-Ali-by-John-Bowring.pdf
    • http://peldoaio.myhome.cx/43d13d73d23d13d7/Lost-Technologies-Of-Ancient-Egypt-Advanced-Engineering-In-The-Temples-Of-The-Pharaohs-by-Christopher-Dunn.pdf
    • http://peldoaio.myhome.cx/73d23d13d1/Reign-of-the-Fallen-Reign-of-the-Fallen-1-by-Sarah-Glenn-Marsh.pdf
    • http://peldoaio.myhome.cx/43d73d63d23d73d3/Yorkshire-Ripper---The-Secret-Murders-The-True-Story-of-How-Peter-Sutcliffe-s-Terrible-Reign-of-Terror-Claimed-at-Least-Twenty-Two-More-Lives-by-Chris-Clark.pdf
    • http://peldoaio.myhome.cx/53d43d63d43d33d8/Egypt-Land-of-the-Pharaohs-by-Regine-Schulz.pdf
    • http://peldoaio.myhome.cx/73d13d53d43d3/Inside-Egypt-The-Land-of-the-Pharaohs-on-the-Brink-of-a-Revolution-by-John-R-Bradley.pdf
    • http://peldoaio.myhome.cx/23d33d93d33d63d9/Discovery-at-Rosetta-The-Ancient-Stone-that-Unblocked-the-Mysteries-of-Ancient-Egypt-by-Jonathan-Downs.pdf
    • http://peldoaio.myhome.cx/13d83d73d93d03d7/Reign-of-Ash-The-Chosen-2-by-Meg-Anne.pdf
    • http://peldoaio.myhome.cx/23d03d13d53d63d0/The-Reign-of-the-Kingfisher-by-T-J-Martinson.pdf
    • http://peldoaio.myhome.cx/13d33d13d73d4/Rain-Reign-by-Ann-M-Martin.pdf
    • http://peldoaio.myhome.cx/23d13d43d03d13d9/Akito-Alpha-s-Reign-2-by-Zoe-Perdita.pdf
    • http://peldoaio.myhome.cx/53d33d43d23d4/Free-Reign-by-Rosemary-Aubert.pdf
    • http://peldoaio.myhome.cx/13d23d73d03d43d1/The-Reign-Verindon-3-by-Lynne-Stringer.pdf
    • http://peldoaio.myhome.cx/83d03d93d43d83d0/A-Reign-Supreme-by-Richard-Crystal.pdf
    • http://peldoaio.myhome.cx/33d03d73d73d73d8/Cthulhu-s-Reign-by-Darrell-Schweitzer.pdf
    • http://peldoaio.myhome.cx/53d93d23d33d73d4/The-Eighth-Octave-by-Eden-Reign.pdf
    • http://peldoaio.myhome.cx/73d13d93d1/Reign-the-Earth-The-Elementae-1-by-A-C-Gaughen.pdf
    • http://peldoaio.myhome.cx/43d03d93d43d13d5/Reign-of-Hell-by-Sven-Hassel.pdf
    • http://peldoaio.myhome.cx/43d73d63d23d73d3/Yorkshire-Ripper---The-Secret-Murders-The-True-Story-

Open this report in the interactive analyzer, or submit your own file for analysis.