Malicious PDF — malware analysis report

Static analysis result for SHA-256 c81249c6192fffed…

MALICIOUS

PDF

21.4 KB Created: 2020-03-19 03:48:52 +00:00 Authoring application: mPDF 5.7
MD5: 23883ecd5acf07383bbf83b60bf1e30c SHA-1: 8b41c5fa09da683658289cbcf56e83fd1c22aa58 SHA-256: c81249c6192fffed64f4e24430d64dd6ee428062e571b172cbaf16e8283b570a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a large number of embedded URLs pointing to a domain with a numeric slug, indicative of SEO poisoning or a link farm. The ML classifier strongly flagged this PDF as malicious. The primary attack pattern involves directing users to a collection of external PDF documents, likely to distribute malware or engage in phishing. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kitasdyu.myhome.cx/5876878871878870/Christmas-with-Charles-Dickens-A-Christmas-Carol-the-Chimes-the-Cricket-on-the-Hearth-the-Battle-of-Life-the-Haunted-Man-and-the-Ghost-s-Bargain-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/1871879871877874879/Charles-Dickens-Eine-Weihnachtsgeschichte-A-Christmas-Carol-amp-Vier-weitere-Weihnachtsstories-Illustriert-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/1870877875871878875/Charles-Dickens-A-Christmas-Carol-A-Radio-Dramatization-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/8870875874874872/A-Christmas-Carol-Victorian-Carols-with-Readings-from-Dickens-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/9877875872875876/A-Christmas-Carol-In-Prose-Being-a-Ghost-Story-of-Christmas-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/7876872872877872/A-Christmas-Carol-A-Ghost-Story-of-Christmas-Illustrated-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/5873872875872874/A-Christmas-Carol-In-Prose-Being-a-Ghost-Story-of-Christmas-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/6874876879877870/A-Christmas-Carol-A-Ghost-Story-of-Christmas-Illustrated-with-Notes-and-Biography-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/1874870876873879/The-Man-Who-Invented-Christmas-How-Charles-Dickens-s-A-Christmas-Carol-Rescued-His-Career-and-Revived-Our-Holiday-Spirits-by-Les-Standiford.pdf
    • http://kitasdyu.myhome.cx/3879875871874/A-Christmas-Carol-and-Other-Christmas-Writings-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/8879873873875874/A-Christmas-Carol-And-Other-Christmas-Stories-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/2873870875874879/A-Christmas-Carol-and-The-Night-Before-Christmas-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/7871873877875872/A-Christmas-Carol-and-Other-Christmas-Books-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/8876874872877873/Een-kerstlied-in-proza-en-andere-kerstverhalen-s-Werelds-meest-geliefde-boeken-30-A-Christmas-Carol-and-other-Christmas-stories-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/4873874872876876/Christmas-Books-A-Christmas-Carol-The-Chimes-The-Cricket-on-the-Hearth-The-Battle-of-Life-The-Haunted-Man-and-the-Ghost-s-Bargain-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/7873873876878871/A-Christmas-Carol-In-many-scenes-and-several-songs-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/8872877871878871/A-Christmas-Carol-with-full-biography-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/8877875877879873/Charles-Dickens-A-Christmas-Carol-by-Brett-Helquist.pdf
    • http://kitasdyu.myhome.cx/8877875878878871/A-Christmas-Carol---Drama-Play-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/5878871877872877/A-Christmas-Carol---The-Ghost-Story-by-Charles-Dickens.pdf
    • http://kitasdyu.myhome.cx/7876872872877872/A-Christmas-Carol-A-Ghost-Story-of-Christmas-Il

Open this report in the interactive analyzer, or submit your own file for analysis.