Malicious PDF — malware analysis report

Static analysis result for SHA-256 c75b722e1c14ca49…

MALICIOUS

PDF

25.2 KB Created: 2020-03-18 21:58:09 +00:00 Authoring application: mPDF 5.7 First seen: 2021-06-04
MD5: 144211f13fa9729294e6ada2797f7f8b SHA-1: 295c612fc0822a210012816780188eba2afa83ef SHA-256: c75b722e1c14ca49ba858445d64aaba1abdb561c3ebe458eb4291a64273ceea9
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified as a link farm, which is a common technique for distributing malware. The ML classifier also flagged this PDF as malicious. The presence of a "download button" heuristic further suggests a deceptive user interaction is intended. The links point to a domain that appears to be used for hosting potentially malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9695

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ujcsiniio.myhome.cx/8cd4cd5cd9cd4cd5/Bach-Chorales-for-Strings-28-Chorales-For-String-Bass-by-Johann-Sebastian-Bach.pdf In PDF document text
    • http://ujcsiniio.myhome.cx/1cd0cd5cd3cd8cd6cd1/Acht-kleine-Pr-ludien-und-Fugen-fr-her-J-S-Bach-zugeschrieben-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/4cd9cd7cd5cd9cd8/The-Bach-Reader-A-Life-of-Johann-Sebastian-Bach-in-Letters-and-Documents-by-Hans-T-David.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/8cd0cd9cd0cd7cd3/Johann-Sebastian-Bach-by-Rick-Marschall.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/5cd7cd8cd0cd3cd6/The-Art-of-the-Fugue-and-A-Musical-Offering-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/8cd7cd1cd3cd4cd9/Cantata-No-140-Wachet-auf-uns-ruft-die-Stimme-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/8cd4cd5cd9cd3cd7/371-Harmonized-Chorales-and-69-Chorale-Melodies-with-Figured-Bass-by-Albert-Riemenschneider.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/1cd0cd3cd1cd3cd5cd4/Liebster-Jesu-wir-sind-hier-BWV731-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/9cd0cd5cd6cd7cd1/-Die-Liebe-zieht-mit-sanften-Schritten-Aria-No-2-from-Cantata-No-36-1-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/1cd1cd3cd8cd0cd3cd4/Cantata-No-12----Weinen-Klagen-Sorgen-Zagen-Satb-with-Atb-Soli-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/9cd6cd4cd1cd6cd3/Cantata-No-25----Es-Ist-Nichts-Gesundes-an-Meinem-Leibe-Satb-with-Stb-Soli-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/1cd0cd3cd1cd4cd4cd2/Cantata-No-123----Liebster-Immanuel-Herzog-Der-Frommen-Satb-with-Atb-Soli-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/1cd1cd8cd7cd3cd4cd8/Naturschutzgebiet-in-Wuppertal-Dussel-Staatsforst-Burgholz-Morsbach-Deilbach-Mirker-Bach-Marscheider-Bach-Herbringhauser-Bach-Gelpetal-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/1cd0cd5cd4cd0cd4cd9/Orgelwerke-in-9-B-nden---Band-8-Konzerte-BWV-592-595-8-kleine-Pr-ludien-und-Fugen-BWV-553-560-Einzelwerke-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/1cd1cd1cd8cd8cd2cd4/-quot-Kreuz-und-Krone-sind-verbunden-quot-aria-No-4-from-Cantata-No-12-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/9cd4cd6cd4cd8cd4/Cantata-No-11----Obet-Gott-in-Seinen-Reichen-Satb-with-Satb-Soli-by-Johann-Sebastian-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/8cd0cd0cd7cd2cd0/A-Christmas-Pastorale-600-Years-of-Carols-Chorales-Preludes-amp-Pastorales-for-Two-Guitars-by-Michael-Newman.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/3cd7cd7cd7cd8cd9/Valhalla-by-Ari-Bach.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/7cd2cd4cd4cd0cd0/Allemande-and-Bourre-by-Bach-J-S-.pdfIn PDF document text
    • http://ujcsiniio.myhome.cx/1cd0cd2cd8cd5cd3cd5/Bach-by-Marielle-Khoury.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.