Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca7493943f35a085…

MALICIOUS

PDF

18.8 KB Created: 2020-03-12 04:15:31 +00:00 Authoring application: mPDF 5.7
MD5: 2bf1baf9fe4df597cd4664ecbb34a229 SHA-1: 99aec953253baa2b3d4ce2e761473acfe05201f2 SHA-256: ca7493943f35a08549633bc02aa6c7343f633f3c8786abb8401d1e57526a8771
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to a suspicious domain, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains these URLs, suggesting a lure to external content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9912

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/281678166816581688167/The-Martian-Marauders-Jack-Commer-Supreme-Commander-1-by-Michael-D-Smith.pdf
    • http://owlaokopdf.myhome.cx/381608162816681638167/Equilibrium-A-Marauders-Interlude-Marauders-4-5-by-Lina-Andersson.pdf
    • http://owlaokopdf.myhome.cx/1816181608168816081688162/The-Martian-Cabal-by-Michael-Burnside.pdf
    • http://owlaokopdf.myhome.cx/881608169816481668168/The-Call-of-the-Wild-illustrated-Supreme-Edition-by-Jack-London.pdf
    • http://owlaokopdf.myhome.cx/381608166816981628160/Supreme-Power-Volume-2-by-J-Michael-Straczynski.pdf
    • http://owlaokopdf.myhome.cx/181648163816281608167/Supreme-Conflict-The-Inside-Story-of-the-Struggle-for-Control-of-the-United-States-Supreme-Court-by-Jan-Crawford-Greenburg.pdf
    • http://owlaokopdf.myhome.cx/881608169816581668166/The-New-Avengers-Volume-11-Search-for-the-Sorcerer-Supreme-by-Brian-Michael-Bendis.pdf
    • http://owlaokopdf.myhome.cx/181608169816881678162/From-Jim-Crow-to-Civil-Rights-The-Supreme-Court-and-the-Struggle-for-Racial-Equality-by-Michael-J-Klarman.pdf
    • http://owlaokopdf.myhome.cx/681658166816381638163/Opinion-of-the-Justices-of-the-Supreme-Court-Relative-to-Chapter-800-of-the-Public-Laws-the-Narragansett-Indians-Given-to-the-Senate-at-the-Janua-by-Rhode-Island-Supreme-Court.pdf
    • http://owlaokopdf.myhome.cx/681648165816881678168/50-Most-Cited-US-Supreme-Court-Decisions-by-United-States-Supreme-Court.pdf
    • http://owlaokopdf.myhome.cx/381688167816281658165/Cutlass-Supreme-Cutlass-Supreme-Episode-1-by-Phillippe-Diederich.pdf
    • http://owlaokopdf.myhome.cx/381698163816781658161/Jack-the-Kitten-is-Very-Brave-by-Tabitha-Grace-Smith.pdf
    • http://owlaokopdf.myhome.cx/1816081688164816881668162/On-Jack-Smith-s-Flaming-Creatures-and-Other-Secret-Flix-of-Cinemaroc-by-J-Hoberman.pdf
    • http://owlaokopdf.myhome.cx/281668168816481608165/After-the-Exhibition-Jack-Haldean-Murder-Mystery-8-by-Dolores-Gordon-Smith.pdf
    • http://owlaokopdf.myhome.cx/18166816081698163/The-Marauders-by-Charlton-Ogburn-Jr-.pdf
    • http://owlaokopdf.myhome.cx/581658162816781688161/Milo-s-Marauders-by-Danny-King.pdf
    • http://owlaokopdf.myhome.cx/781638165816181618160/The-Marauders-Day-of-the-Halfbreeds-by-Peter-McCurtin.pdf
    • http://owlaokopdf.myhome.cx/481658166816381618169/S-Duality-Marauders-2-5-by-Lina-Andersson.pdf
    • http://owlaokopdf.myhome.cx/481628165816081618168/Smiling-Jack-by-Michael-Chambers.pdf
    • http://owlaokopdf.myhome.cx/781608162816981698169/Phantom-Marauders-of-the-Bermuda-Triangle-by-R-C-Farrington.pdf
    • http://owlaokopdf.myhome.cx/181608169816881678162/From

Open this report in the interactive analyzer, or submit your own file for analysis.