Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8fb0dd5562c6de8…

MALICIOUS

PDF

20.5 KB Created: 2019-04-30 03:54:53 +01:00 Authoring application: mPDF 5.7
MD5: eae20210d5412cd31549c76338c985c0 SHA-1: 9028cd1a508344ce29ed5c6387799fc65c3da903 SHA-256: c8fb0dd5562c6de86bf7d4076c3df2af594781bb8408f0ef826bdc5da5011362
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the document body is unreadable, the presence of numerous links suggests a malicious intent, possibly for SEO manipulation or to distribute further malware. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/9a05a00a09a03a03/Verkauft---verraten-Marburg-Krimi-5-by-Jan-Tilden.pdf
    • http://muicuiu.dumb1.com/9a05a01a00a01a09/Verraten-und-verkauft-die-tragischen-Fehler-Churchills-und-Roosevelts-in-Osteuropa-by-Nicholas-Baciu.pdf
    • http://muicuiu.dumb1.com/1a01a05a01a06a01a09/Marburg-Auschwitz-Zur-Verfolgung-Der-Sinti-In-Marburg-Und-Umgebung-by-Udo-Engbring-Romang.pdf
    • http://muicuiu.dumb1.com/1a01a06a05a03a05a00/Bauwerk-Im-Landkreis-Marburg-Biedenkopf-Bauwerk-in-Marburg-Kirchengebaude-Im-Landkreis-Marburg-Biedenkopf-Marburger-Schloss-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a01a08a07a06a05a08/Krimi-007-Blinder-Verdacht-eBook-Krimi-by-K-H-Weimer.pdf
    • http://muicuiu.dumb1.com/9a04a00a07a08a01/Dispatches-An-die-H-lle-verraten-by-Michael-Herr.pdf
    • http://muicuiu.dumb1.com/2a07a04a09a09a05/Last-Chance-Mail-Order-Bride-Violet-s-Cowboy-Westward-Wanted-Book-4-by-Crystal-Anne-Tilden.pdf
    • http://muicuiu.dumb1.com/1a01a08a02a09a00a08/Die-Altesten-Drucke-Aus-Marburg-in-Hessen-1527-1566-by-A-Dommer.pdf
    • http://muicuiu.dumb1.com/9a05a00a09a02a05/Verkauft-an-den-L-wen-by-T-S-Ryder.pdf
    • http://muicuiu.dumb1.com/9a05a00a07a08a05/Verkauft-by-Monika-Wenninger.pdf
    • http://muicuiu.dumb1.com/9a05a00a07a09a05/Verkauft-by-Julia-von-Finkenbach.pdf
    • http://muicuiu.dumb1.com/9a05a00a07a08a08/Verkauft-by-Alexander-Weigand-Schoenherr.pdf
    • http://muicuiu.dumb1.com/9a05a00a08a06a02/Kidnapping-entf-hrt-und-verkauft-by-Allison-Parkham.pdf
    • http://muicuiu.dumb1.com/9a05a00a08a05a00/Tot-verkauft-s-sich-besser-by-Sabine-Herzig.pdf
    • http://muicuiu.dumb1.com/9a05a01a00a02a08/Online-Verkaufskonzepte-So-verkauft-man-heute-by-John-Palameyo.pdf
    • http://muicuiu.dumb1.com/9a05a00a08a06a00/Stieftochter-Jana-Abgerichtet-amp-Verkauft-by-Bianca-Lange.pdf
    • http://muicuiu.dumb1.com/9a05a00a09a03a02/Verschleppt-Verkauft-Versendet-Ein-Erfahrungsbericht-by-Miriam-Malik.pdf
    • http://muicuiu.dumb1.com/1a00a05a04a06a00a08/Reform-Revolution-Oder-Stillstand-Die-68er-Bewegung-an-Den-Evangelisch-Theologischen-Fakultaten-Marburg-Bochum-Und-Der-Kirchlichen-Hochschule-Berlin-by-Tobias-Sarx.pdf
    • http://muicuiu.dumb1.com/9a05a01a00a05a06/Die-Supermarkt-L-ge-Wie-uns-die-Lebensmittelindustrie-f-r-dumm-verkauft-by-J-rg-Zipprick.pdf
    • http://muicuiu.dumb1.com/9a05a01a00a05a01/Verkauft-an-die-Russenmafia-Jungfrau-zur-Benutzung-freigegeben-by-Elena-Suka.pdf
    • http://muicuiu.dumb1.com/1a01a06a05a03a05a00/Bauwerk-Im-Landkreis-Marb

Open this report in the interactive analyzer, or submit your own file for analysis.