Malicious PDF — malware analysis report

Static analysis result for SHA-256 c94af0880dec1397…

MALICIOUS

PDF

22.3 KB Created: 2019-05-04 12:54:48 +01:00 Authoring application: mPDF 5.7
MD5: f4175e577183e1ce4d4b9f79023e56de SHA-1: e0992a8dd20f4b511b5e2ccefef25c4585a360f3 SHA-256: c94af0880dec1397892843d36f9b2ae0bab27979b4fbb32b90d7dbefebbe3af6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on the domain 'unieoooq.linkpc.net'. This heuristic firing, combined with the ML classifier's high confidence, suggests a link-farming or redirection attack. The document body contains obfuscated text and URLs, indicating an attempt to disguise the malicious intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://unieoooq.linkpc.net/44e74e84e74e3/Building-Washington-A-History-of-Washington-State-Public-Works-by-Paul-Dorpat.pdf
    • http://unieoooq.linkpc.net/34e94e54e34e14e4/Watchdogs-of-Democracy-The-Waning-Washington-Press-Corps-and-How-It-Has-Failed-the-Public-by-Helen-Thomas.pdf
    • http://unieoooq.linkpc.net/14e04e74e84e04e84e8/Back-In-The-Groove-New-Orleans-African-American-Romance-The-Aisha-Washington-Collection-Book-5-by-Aisha-Washington.pdf
    • http://unieoooq.linkpc.net/64e94e04e14e84e8/The-Washington-STate-Academic-RedShirt-STARS-in-Engineering-Program-by-Jeremy-Kingma.pdf
    • http://unieoooq.linkpc.net/54e14e14e74e94e5/Building-Louisiana-The-Legacy-of-the-Public-Works-Administration-by-Robert-D-Leighninger-Jr-.pdf
    • http://unieoooq.linkpc.net/64e94e04e14e94e3/Results-and-Lessons-Learned-from-Years-One-and-Two-of-the-Washington-STate-Academic-RedShirt-STARS-Program-by-UW-amp-WSU.pdf
    • http://unieoooq.linkpc.net/84e54e14e54e14e0/The-Sketch-Book-by-Washington-Irving-with-Sketch-of-the-Author-s-Life-and-Compositional-Critical-and-Explanatory-Notes-By-G-A-Chase-by-Washington-Irving.pdf
    • http://unieoooq.linkpc.net/74e54e44e74e24e0/George-Washington-The-Founding-Father-by-Paul-Johnson.pdf
    • http://unieoooq.linkpc.net/34e24e44e94e84e2/Old-Christmas-From-the-Sketch-Book-of-Washington-Irving-by-Washington-Irving.pdf
    • http://unieoooq.linkpc.net/24e34e14e84e2/Washington-A-History-of-the-Capital-1800-1950-by-Constance-McLaughlin-Green.pdf
    • http://unieoooq.linkpc.net/44e14e14e54e04e4/The-Complete-Tales-of-Washington-Irving-by-Washington-Irving.pdf
    • http://unieoooq.linkpc.net/64e54e64e34e74e1/Investing-in-America-s-Infrastructure-Short-And-Long-Term-Strategies-Hearings-Before-the-Subcommittee-on-Economic-Development-of-the-Committee-on-Public-Works-and-Transportation-House-of-Representatives-One-Hundred-Third-Congress-First-Session-Janua-by-Public-Works-and-Transportation-Comm.pdf
    • http://unieoooq.linkpc.net/94e24e94e34e94e9/Presidential-Campaigns-From-George-Washington-to-George-W-Bush-by-Paul-F-Boller-Jr-.pdf
    • http://unieoooq.linkpc.net/74e34e84e74e84e8/No-Homo-by-J-T-Washington.pdf
    • http://unieoooq.linkpc.net/44e84e84e34e0/Washington-by-Ray-Gohs.pdf
    • http://unieoooq.linkpc.net/14e74e24e74e64e8/Washington-D-C-by-Gore-Vidal.pdf
    • http://unieoooq.linkpc.net/94e24e94e34e74e1/Layers-by-AlTonya-Washington.pdf
    • http://unieoooq.linkpc.net/34e94e54e94e34e0/Mohammed-by-Washington-Irving.pdf
    • http://unieoooq.linkpc.net/84e84e04e2/Washington-Black-by-Esi-Edugyan.pdf
    • http://unieoooq.linkpc.net/44e64e04e34e44e6/Up-from-Slavery-by-Booker-T-Washington.pdf
    • http://unieoooq.linkpc.net/64e94e04e14e94e3/Results-and-Lessons-Learned-from-Years-One-and-Two-of-the-Washington-STate-Academic-RedShirt

Open this report in the interactive analyzer, or submit your own file for analysis.