Malicious PDF — malware analysis report

Static analysis result for SHA-256 ced8d8bb085b86e9…

MALICIOUS

PDF

23.7 KB Created: 2020-03-18 21:47:58 +00:00 Authoring application: mPDF 5.7
MD5: f8fe884274033b8700b058fc86475665 SHA-1: 7a41f8766e4357b6069f7f75e86669c95a62034e SHA-256: ced8d8bb085b86e975ac342d841c3755c1269fd386af8b0c2957b31977a89e8b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, constituting a link farm. The ML classifier strongly indicated maliciousness. The primary heuristic identified a mass external PDF link farm, with the first URL being http://rtuninnsi.myhome.cx/76a26a26a96a06a9/Rock-Climbing-Desert-Rock-III-Moab-to-Colorado-National-Monument-by-Eric-Bjornstad.pdf. This suggests a social engineering or SEO poisoning attack designed to drive traffic to potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9711

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rtuninnsi.myhome.cx/76a26a26a96a06a9/Rock-Climbing-Desert-Rock-III-Moab-to-Colorado-National-Monument-by-Eric-Bjornstad.pdf
    • http://rtuninnsi.myhome.cx/76a26a26a86a16a8/Desert-Rock-I-Rock-Climbs-in-the-National-Parks-by-Eric-Bjornstad.pdf
    • http://rtuninnsi.myhome.cx/76a26a26a96a86a9/Desert-Rock-A-Climber-s-Guide-to-the-Canyon-Country-of-the-American-Southwest-Desert-by-Eric-Bjornstad.pdf
    • http://rtuninnsi.myhome.cx/76a26a26a96a06a4/Desert-Rock-II-Wall-Street-to-the-San-Rafael-Swell-Wall-Street-to-the-San-Rafael-Swell-by-Eric-Bjornstad.pdf
    • http://rtuninnsi.myhome.cx/86a76a46a16a76a3/Colorado-National-Monument-The-Story-Behind-the-Scenery-by-Henry-A-Schoch.pdf
    • http://rtuninnsi.myhome.cx/76a46a86a76a56a0/Two-Dimensional-Computer-Modeling-of-Green-River-at-Dinosaur-National-Monument-and-Canyonlands-National-Park-by-Dan-Gessler.pdf
    • http://rtuninnsi.myhome.cx/46a96a86a26a06a7/Rock-of-Ages-The-Rolling-Stone-History-of-Rock-and-Roll-by-Ed-Ward.pdf
    • http://rtuninnsi.myhome.cx/36a46a36a06a16a8/Rock-All-Night-The-Rock-Star-s-Seduction-2-by-Olivia-Thorne.pdf
    • http://rtuninnsi.myhome.cx/16a46a66a86a06a2/Rock-Addiction-Rock-Kiss-1-by-Nalini-Singh.pdf
    • http://rtuninnsi.myhome.cx/36a26a76a36a46a8/Rock-Addiction-Rock-Kiss-1-by-Nalini-Singh.pdf
    • http://rtuninnsi.myhome.cx/16a86a66a16a46a2/Rock-A-Rock-Star-Romantic-Suspense-by-J-A-Huss.pdf
    • http://rtuninnsi.myhome.cx/16a16a96a76a56a86a7/AC-DC-Maximum-Rock-Roll-The-Ultimate-Story-of-the-World-s-Greatest-Rock-and-Roll-Band-by-Murray-Engleheart.pdf
    • http://rtuninnsi.myhome.cx/16a86a26a36a86a0/The-Rock-Says-by-Dwayne-39-The-Rock-39-Johnson.pdf
    • http://rtuninnsi.myhome.cx/46a96a66a06a96a6/It-s-Only-Rock-and-Roll-An-Anthology-of-Rock-and-Roll-Short-Stories-by-Janice-Eidus.pdf
    • http://rtuninnsi.myhome.cx/96a06a26a36a36a1/7th-Heaven-and-the-Rock-n-roll-Kids-Rock-n-roll-to-the-Rescue-Art-and-Introduction-by-Roy-Adorjan.pdf
    • http://rtuninnsi.myhome.cx/76a16a56a76a36a1/Groupe-de-Rock-Finlandais-Indica-the-Rasmus-Iconcrash-Hanoi-Rocks-the-Do-Waltari-Elakelaiset-22-Pistepirkko-Liste-Des-Groupes-Ou-Artistes-de-Rock-Finlandais-Negative-the-69-Eyes-Pmmp-Uniklubi-Wigwam-Kwan-Charon-by-Source-Wikipedia.pdf
    • http://rtuninnsi.myhome.cx/26a36a26a46a36a2/Rock-Chick-Rescue-Rock-Chick-2-by-Kristen-Ashley.pdf
    • http://rtuninnsi.myhome.cx/16a16a66a26a66a0/Rock-Chick-Redux-Rock-Chick-8-5-by-Kristen-Ashley.pdf
    • http://rtuninnsi.myhome.cx/36a86a46a36a2/Rock-Chick-Revenge-Rock-Chick-5-by-Kristen-Ashley.pdf
    • http://rtuninnsi.myhome.cx/26a16a96a96a36a0/Rock-Stars-Do-It-Forever-Rock-Stars-Do-It-3-by-Jasinda-Wilder.pdf
    • http://rtuninnsi.myhome.cx/86

Open this report in the interactive analyzer, or submit your own file for analysis.