Malicious PDF — malware analysis report

Static analysis result for SHA-256 cef5b1b906b02811…

MALICIOUS

PDF

19.6 KB Created: 2019-04-30 05:32:01 +01:00 Authoring application: mPDF 5.7
MD5: 1a27ffb96c004ff7b9df2ce176e0f410 SHA-1: f354af485a1746a1bcb993ee5bcb1950fd88c1a6 SHA-256: cef5b1b906b02811b6a191ba0055d8328c13b43922808cef310e9a059dba0844
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. While the specific URLs extracted were flagged as benign, the heuristic 'PDF_SEO_LINK_FARM' indicates a mass linking strategy. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, and the document body was unreadable, limiting further analysis of the exact intent beyond link farming.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a07a03a01a01a03/The-Unwritten-Tommy-Taylor-and-the-Ship-That-Sank-Twice-by-Mike-Carey.pdf
    • http://muicuiu.dumb1.com/4a03a09a02a04a02/Tommy-Black-and-the-Staff-of-Light-Tommy-Black-1-by-Jake-Kerr.pdf
    • http://muicuiu.dumb1.com/7a07a02a05a05a00/Virgin-Sacrifice-Bred-to-the-Beast-The-Virgin-Trilogy-2-by-Fannie-Tucker.pdf
    • http://muicuiu.dumb1.com/7a07a02a06a05a08/Virgin-Prisoner-Bred-to-the-Beast-The-Virgin-Trilogy-3-by-Fannie-Tucker.pdf
    • http://muicuiu.dumb1.com/6a07a02a03a07a02/Birth-Journeys---positive-birth-stories-to-encourage-and-inspire-by-Leonie-MacDonald.pdf
    • http://muicuiu.dumb1.com/7a06a07a09a06a09/The-Virgin-s-Fake-Fiance-The-Virgin-1-by-Kim-Loraine.pdf
    • http://muicuiu.dumb1.com/9a08a08a08a08a05/Mother-s-Intention-How-Belief-Shapes-Birth---A-Commonsense-Guide-to-Safe-Comfortable-Guilt-Free-Birth-in-Five-Simple-Steps-by-Kim-Wildner.pdf
    • http://muicuiu.dumb1.com/7a01a06a07a09a07/Tommy-Robinson-Enemy-of-the-State-by-Tommy-Robinson.pdf
    • http://muicuiu.dumb1.com/6a02a06a00a08/V-is-for-Virgin-V-is-for-Virgin-1-by-Kelly-Oram.pdf
    • http://muicuiu.dumb1.com/6a06a09a04a01a08/The-Virgin-Revenge-The-Virgin-1-by-J-Dallas.pdf
    • http://muicuiu.dumb1.com/9a09a03a06a09a06/Reincarnation-and-Biology-A-Contribution-to-the-Etiology-of-Birthmarks-and-Birth-Defects-Volume-2-Birth-Defects-and-Other-Anomalies-by-Ian-Stevenson.pdf
    • http://muicuiu.dumb1.com/7a01a02a04a04a05/The-Birth-Date-Book-April-1-What-Your-Birth-Date-Reveals-about-You-by-Ariel-Books.pdf
    • http://muicuiu.dumb1.com/2a00a00a05a02a04/A-Virgin-River-Christmas-Virgin-River-4-by-Robyn-Carr.pdf
    • http://muicuiu.dumb1.com/3a01a02a04a08a09/Books-for-Kids-Tommy-Tiger-and-the-New-Bike-Illustration-Book-Ages-3-8-Short-Stories-for-Kids-Kids-Books-Bedtime-Stories-For-Kids-Children-Books-Early-Readers-by-Tommy-Tiger.pdf
    • http://muicuiu.dumb1.com/3a03a01a09a09a07/The-Virgin-Billionaire-Virgin-Billionaire-1-by-Ryan-Field.pdf
    • http://muicuiu.dumb1.com/5a04a08a02a08/The-Syrian-Virgin-The-Syrian-Virgin-1-by-Zack-Love.pdf
    • http://muicuiu.dumb1.com/9a09a03a07a01/The-Syrian-Virgin-The-Syrian-Virgin-1-by-Zack-Love.pdf
    • http://muicuiu.dumb1.com/8a01a07a04/There-There-by-Tommy-Orange.pdf
    • http://muicuiu.dumb1.com/4a04a00a07a06a00/Tommyland-by-Tommy-Lee.pdf
    • http://muicuiu.dumb1.com/7a00a09a08a02a08/The-Whole-Works-of-the-Right-Rev-Jeremy-Taylor-Worthy-Communicant-Supplement-of-Sermons-Collection-of-Offices-by-Jeremy-Taylor.pdf
    • http://muicuiu.dumb1.com/9a08a08a08a08a05/Mo

Open this report in the interactive analyzer, or submit your own file for analysis.