Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb5b227b24d0f411…

MALICIOUS

PDF

20.9 KB Created: 2019-05-02 17:38:22 +01:00 Authoring application: mPDF 5.7
MD5: 9d41d44ae09f36ee3c2e14c0aba6bc05 SHA-1: c5c7ff1e31ddcca2c4816c81cc9b70131bea1805 SHA-256: cb5b227b24d0f4118491424eba74bc551e9df55cee3dbcdbe309b012cf37d10c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on the dynamic DNS domain 'cmeinasaoo.duckdns.org'. This heuristic firing suggests a link farm intended to drive traffic or potentially distribute further malicious content. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9904

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/4b29b29b29b28b23/Time-Trip-A-Time-After-Time-Reincarnation-Novella-Time-After-Time-Reincarnation-Lives-Book-1-by-Wendy-Godding.pdf
    • http://cmeinasaoo.duckdns.org/4b27b25b21b25b29/After-Cilmeri-Boxed-Set-Daughter-of-Time-Footsteps-in-Time-Winds-of-Time-Prince-of-Time-The-After-Cilmeri-Series-by-Sarah-Woodbury.pdf
    • http://cmeinasaoo.duckdns.org/1b25b28b26b24/The-Young-United-States-1783-1830-A-Time-of-Change-and-Growth-a-Time-of-Learning-Democracy-a-Time-of-New-Ways-of-Living-Thinking-and-Doing-by-Edwin-Tunis.pdf
    • http://cmeinasaoo.duckdns.org/3b22b21b29b28b28/Three-in-Time-The-Winds-of-Time-The-Year-of-the-Quiet-Sun-There-Will-Be-Time-by-Chad-Oliver.pdf
    • http://cmeinasaoo.duckdns.org/1b27b24b27b26b24/Time-After-Time-Time-Between-Us-2-by-Tamara-Ireland-Stone.pdf
    • http://cmeinasaoo.duckdns.org/9b27b24b28b23b29/15-Take-Your-Time-A-Book-on-Time-Management-and-Life-Planning-by-Kevin-Hockensmith.pdf
    • http://cmeinasaoo.duckdns.org/9b22b21b29b27b27/Time-Fragility-Time-Riven-Book-2-by-Jonathan-Seyfried.pdf
    • http://cmeinasaoo.duckdns.org/4b20b26b20b26b28/The-Time-Chamber-A-Magical-Story-and-Coloring-Book-Time-Adult-Coloring-Books-by-Daria-Song.pdf
    • http://cmeinasaoo.duckdns.org/4b23b29b23b22b20/Time-Anomaly-A-Time-Travel-Romance-Echo-Trilogy-2-by-Lindsey-Fairleigh.pdf
    • http://cmeinasaoo.duckdns.org/4b24b20b21b22b26/So-You-Created-a-Wormhole-The-Time-Traveler-s-Guide-to-Time-Travel-by-Phil-Hornshaw.pdf
    • http://cmeinasaoo.duckdns.org/1b24b24b24b23b24/Time-Lord-Sir-Sandford-Fleming-and-the-Creation-of-Standard-Time-by-Clark-Blaise.pdf
    • http://cmeinasaoo.duckdns.org/7b20b20b22b25b25/In-Search-Of-Lost-Time-Vol-4-The-Fugitive-amp-Time-Regained-by-Marcel-Proust.pdf
    • http://cmeinasaoo.duckdns.org/1b21b26b29b21b28b20/Echoes-in-Time-Time-Traders-Ross-Murdock-6-by-Andre-Norton.pdf
    • http://cmeinasaoo.duckdns.org/2b21b28b22b28b22/The-Worst-of-Time-Lens-of-Time-Star-Rover-5-by-Saxon-Andrew.pdf
    • http://cmeinasaoo.duckdns.org/2b27b27b21b28b22/Adventures-Through-Time-Time-Patrol-Nancy-Laplante-2-by-Michel-Poulin.pdf
    • http://cmeinasaoo.duckdns.org/2b26b29b29b28b22/100-Photographs-The-Most-Influential-Images-of-All-Time-by-The-Editors-of-Time-Magazine.pdf
    • http://cmeinasaoo.duckdns.org/1b23b27b20b26b26/Time-Regained-In-Search-of-Lost-Time-7-by-Marcel-Proust.pdf
    • http://cmeinasaoo.duckdns.org/3b29b22b21b24b23/Ripping-Time-Time-Scout-3-by-Robert-Lynn-Asprin.pdf
    • http://cmeinasaoo.duckdns.org/8b28b29b28b21b22/Time-Regained-In-Search-of-Lost-Time-vol-7-by-Marcel-Proust.pdf
    • http://cmeinasaoo.duckdns.org/5b20b25b29b28/Time-To-Learn-Reloaded-Time-Will-Reveal-1-by-Black-Coffee.pdf
    • http://cmeinasaoo.duckdns.org/1b25b28b26b24/The-Young-United-States-1783-1830-A-Time-of-Change-and-Growth-a