Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca3ae8864e9808b3…

MALICIOUS

PDF

20.2 KB Created: 2019-05-07 04:41:58 +01:00 Authoring application: mPDF 5.7
MD5: e7ca190cc645881097eac951c8c3bdfc SHA-1: 9827cb16e4de9ae07aab676d9a57da249ac7a6a7 SHA-256: ca3ae8864e9808b30a0f2d42401a29568bcbf1bd54c22b21e2acc7441438581f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of embedded URLs. The heuristic 'PDF_SEO_LINK_FARM' indicates these URLs are part of a link farm, suggesting a tactic to manipulate search engine results or distribute malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a00a07a08a09a04a06/The-New-Hugo-Winners-Vol-3-1989-1991-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/2a06a06a07a02a01/Time-is-the-Fire-The-Best-of-Connie-Willis-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/4a04a03a08a08a05/The-Hugo-Winners-1955-1961-by-Isaac-Asimov.pdf
    • http://muicuiu.dumb1.com/7a05a08a01a05/The-Hugo-Winners-Vol-1-and-2-1955-1970-by-Isaac-Asimov.pdf
    • http://muicuiu.dumb1.com/2a00a08a00a03a06/All-about-Emily-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/2a04a05a06a09/The-Last-of-the-Winnebagos-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/3a01a06a08a06a06/All-Clear-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/1a06a03a08a00a08/Fire-Watch-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/4a00a05a07a07a09/Futures-Imperfect-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/3a00a01a02a05a05/Blackout-All-Clear-1-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/4a07a04a00a09a05/Blackout-All-Clear-1-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/8a02a08a01a03/Miracle-and-Other-Christmas-Stories-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/1a00a01a08a01a04a07/Das-Narrative-Selbst---Studien-Zum-Erzaehlwerk-Wolfgang-Hilbigs-Erzaehlungen-1979-1991---Romane-1989-2000-by-Andr-Steiner.pdf
    • http://muicuiu.dumb1.com/4a09a00a04a01a04/Doomsday-Book-Oxford-Time-Travel-1-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/3a07a07a02a08a01/Doomsday-Book-Oxford-Time-Travel-1-by-Connie-Willis.pdf
    • http://muicuiu.dumb1.com/8a05a09a05a09a09/Strings-amp-Symmetries-1991-Proceedings-Of-The-Conference-Stony-Brook-May-20-25-1991-by-H-Itoyama.pdf
    • http://muicuiu.dumb1.com/9a00a07a03a08a02/Im-Zeichen-Des-Heiligen-Geistes-Bericht-Aus-Canberra-1991-Offizieller-Bericht-Der-Siebten-Vollversammlung-Des-Okumenischen-Rates-Der-Kirchen-7-Bis-20-Februar-1991-in-Canberra-Australien-by-World-Council-of-Churches.pdf
    • http://muicuiu.dumb1.com/7a05a06a00a08a03/Les-Mis-rables-By-Victor-Hugo---Illustrated-Free-Audiobook-Unabridged-Original-E-Reader-Friendly-by-Victor-Hugo.pdf
    • http://muicuiu.dumb1.com/7a05a07a06a00a03/The-Works-of-Victor-Hugo-Hans-of-Iceland-Bug-Jargal-Claude-Gueux-by-Victor-Hugo.pdf
    • http://muicuiu.dumb1.com/6a09a02a00a09a00/We-Are-Not-All-Winners-by-Noell-K-Wolfgram-Evans.pdf
    • http://muicuiu.dumb1.com/8a02a08a01a03/Miracle-and-Ot

Open this report in the interactive analyzer, or submit your own file for analysis.