Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc7cabf37f432d47…

MALICIOUS

PDF

16.2 KB Created: 2019-05-07 09:40:58 +01:00 Authoring application: mPDF 5.7
MD5: 45d5a649aaf4afced5aa763ae8686a45 SHA-1: 49e98e5d7a31c6674b7e0d541e6bc5b35122fa2c SHA-256: cc7cabf37f432d47032535fe9cb0022ce0a9446c953c0c865d2cfee0c36baea8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDFs hosted on the domain 'muicuiu.dumb1.com'. This is indicative of a link farm or a lure to a malicious site, likely for SEO poisoning or to host further malicious content. The ML classifier also flagged this PDF as malicious with a high score. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/4a02a01a01/Fractured-by-Catherine-McKenzie.pdf
    • http://muicuiu.dumb1.com/3a09a08a05a03/Arranged-by-Catherine-McKenzie.pdf
    • http://muicuiu.dumb1.com/7a07a09a06/The-Good-Liar-by-Catherine-McKenzie.pdf
    • http://muicuiu.dumb1.com/4a04a09a07a06a05/The-Good-Liar-by-Catherine-McKenzie.pdf
    • http://muicuiu.dumb1.com/4a06a02a04a02a02/The-Good-Liar-by-Catherine-McKenzie.pdf
    • http://muicuiu.dumb1.com/2a08a02a02a02a05/Smoke-Signals-Tulsa-Thunderbirds-2-by-Catherine-Gayle.pdf
    • http://muicuiu.dumb1.com/1a01a08a03a04a06a08/Like-to-Die-A-McKenzie-Novel-Twin-Cities-P-I-Mac-McKenzie-Novels-Book-15-by-David-Housewright.pdf
    • http://muicuiu.dumb1.com/3a03a00a04a02a02/Smoke-and-Mirrors-Smoke-and-Mirrors-1-by-Lillian-T-MacGowan.pdf
    • http://muicuiu.dumb1.com/3a05a04a09a01a01/The-Smoke-Thieves-The-Smoke-Thieves-1-by-Sally-Green.pdf
    • http://muicuiu.dumb1.com/2a00a09a05a07a03/The-Best-of-Catherine-Caffeinated-Caffeine-Infused-Self-Publishing-Advice-by-Catherine-Ryan-Howard.pdf
    • http://muicuiu.dumb1.com/3a09a02a07a00a05/Daughter-of-Smoke-amp-Bone-Daughter-of-Smoke-amp-Bone-1-by-Laini-Taylor.pdf
    • http://muicuiu.dumb1.com/2a02a00a06a04a06/Empress-of-the-Night-A-Novel-of-Catherine-the-Great-Catherine-2-by-Eva-Stachniak.pdf
    • http://muicuiu.dumb1.com/1a01a09a09a07a04/The-Winter-Palace-A-Novel-of-Catherine-the-Great-Catherine-1-by-Eva-Stachniak.pdf
    • http://muicuiu.dumb1.com/5a09a02a02a08a01/Belle-Catherine-Catherine-3-by-Juliette-Benzoni.pdf
    • http://muicuiu.dumb1.com/2a06a08a06a07a08/The-Summer-We-Got-Free-by-Mia-McKenzie.pdf
    • http://muicuiu.dumb1.com/9a02a05a03a07a04/Pus-Junkies-by-Shane-McKenzie.pdf
    • http://muicuiu.dumb1.com/2a05a02a07a09a09/The-Portable-Veblen-by-Elizabeth-Mckenzie.pdf
    • http://muicuiu.dumb1.com/1a01a08a03a04a07a02/Treat-Your-Own-Back-by-Robin-McKenzie.pdf
    • http://muicuiu.dumb1.com/1a02a00a04a08a01/Close-My-Eyes-by-Sophie-McKenzie.pdf
    • http://muicuiu.dumb1.com/3a02a01a00a05a03/Guinevere-s-Gift-by-Nancy-McKenzie.pdf
    • http://muicuiu.dumb1.com/2a00a09a05a07a03/The-Bes

Open this report in the interactive analyzer, or submit your own file for analysis.