Malicious PDF — malware analysis report

Static analysis result for SHA-256 d35b48fab1844d97…

MALICIOUS

PDF

16.8 KB Created: 2019-05-03 06:09:03 +01:00 Authoring application: mPDF 5.7
MD5: e73f448b3d0b9a4a5a6ed25526f149e1 SHA-1: ef9f3b29486ce6f90aae18714d72e4071e2b4794 SHA-256: d35b48fab1844d9745ad4ca92590f34ec6657c9b3720ab881aa14e62401c01d3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While most of these links point to what appear to be benign book titles, the sheer volume and the ML_NYX_PDF_MALICIOUS classification suggest a malicious intent, likely to direct users to harmful content or exploit kits. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a09a06a00a06a04/Lioness-Rampant-Song-of-the-Lioness-4-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/3a00a00a01a05a07/Lioness-Rampant-Song-of-the-Lioness-4-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/4a03a09a07a05a06/The-Song-of-the-Lioness-Quartet-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/3a04a02a02a05/The-Woman-Who-Rides-Like-a-Man-Song-of-the-Lioness-3-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/3a01a06a09a06a06/Alanna-The-First-Adventure-Song-of-the-Lioness-1-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/8a06a08a01a00/The-Woman-Who-Rides-Like-a-Man-Song-of-the-Lioness-3-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/3a04a01a01a01/In-the-Hand-of-the-Goddess-Song-of-the-Lioness-2-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/5a05a05a00a04a00/A-Can-o-de-Alanna-A-Primeira-Grande-Aventura-Song-of-the-Lioness-1-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/4a08a06a04a03/Tricksters-Daughter-of-the-Lioness-1-2-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/1a07a06a01a03a03/Trickster-s-Choice-Daughter-of-the-Lioness-1-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/3a03a05a01a06/Trickster-s-Queen-Daughter-of-the-Lioness-2-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/4a00a05a06a04a00/Trickster-s-Choice-Daughter-of-the-Lioness-1-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/6a06a06a06/Trickster-s-Choice-Daughter-of-the-Lioness-1-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/3a03a06a01a05/Trickster-s-Choice-Daughter-of-the-Lioness-1-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/4a00a04a01a05a09/Trickster-s-Queen-Daughter-of-the-Lioness-2-by-Tamora-Pierce.pdf
    • http://muicuiu.dumb1.com/1a01a06a08a07a02a05/Novels-by-Tamora-Pierce-Study-Guide-Emelanese-Books-Tortallan-Books-Daughter-of-the-Lioness-the-Will-of-the-Empress-by-Books-LLC.pdf
    • http://muicuiu.dumb1.com/2a06a02a07a05a04/Ja-Rael-s-Lioness-by-Angelique-Anjou.pdf
    • http://muicuiu.dumb1.com/5a08a03a07/The-Lioness-of-Morocco-by-Julia-Drosten.pdf
    • http://muicuiu.dumb1.com/2a00a04a01a05a08/The-Lioness-and-the-Spellspinners-by-Cheryl-Mahoney.pdf
    • http://muicuiu.dumb1.com/1a08a07a01a00a00/The-White-Lioness-Wallander-3-by-Henning-Mankell.pdf
    • http://muicuiu.dumb1.com/4a

Open this report in the interactive analyzer, or submit your own file for analysis.