Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3d27804e37789d0…

MALICIOUS

PDF

16.5 KB Created: 2019-04-30 05:19:34 +01:00 Authoring application: mPDF 5.7
MD5: 69071c7022324202a45fa3b647c18033 SHA-1: f12b6368cc9d1325789974e243c4ac05fa5a5ce2 SHA-256: d3d27804e37789d02c4b0f280fe64d47e35339547e7bcccdc3218973ad55be51
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily corrupted and unreadable, the presence of numerous links suggests a malicious intent, possibly for SEO manipulation or to distribute further malware. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dum
    • http://muicuiu.dumb1.com/3a07a06a06a01/The-Fury-The-Vampire-Diaries-3-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/2a07a02a01a09a06/The-Fury-The-Vampire-Diaries-3-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/1a00a03a01a08a09a02/The-Vampire-Diaries---Stefan-s-Diaries---Rache-ist-nicht-genug-Band-3-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/7a05a08a05a03a04/Balthazar-The-Vampire-Diaries-Stefan-s-Diaries-7-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/4a02a01a09a02a02/The-Vampire-Diaries-Origins-Stefan-s-Diaries-1-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/3a06a05a01a00/Bloodlust-The-Vampire-Diaries-Stefan-s-Diaries-2-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/4a00a07a07a00a03/The-Awakening-The-Vampire-Diaries-1-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/3a03a02a08a02/Nightfall-The-Vampire-Diaries-The-Return-1-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/4a03a08a07a06a06/The-Awakening-and-The-Struggle-The-Vampire-Diaries-1-2-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/3a04a00a05a07a06/Shadow-Souls-The-Vampire-Diaries-The-Return-2-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/3a00a02a08a07a00/Shadow-Souls-The-Vampire-Diaries-The-Return-2-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/4a04a02a05a09/Destiny-Rising-The-Vampire-Diaries-The-Hunters-3-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/9a09a00a02a03a00/Matt-and-Elena-First-Date-The-Vampire-Diaries-Extras-0-1-by-L-J-Smith.pdf
    • http://muicuiu.dumb1.com/9a06a03a01a04a08/Cursor-s-Fury-Captain-s-Fury-Princeps-Fury-Codex-Alera-3-5---3-Books-Collection-Set-by-Jim-Butcher.pdf
    • http://muicuiu.dumb1.com/4a07/The-Last-American-Vampire-Abraham-Lincoln-Vampire-Hunter-2-by-Seth-Grahame-Smith.pdf
    • http://muicuiu.dumb1.com/1a00a02a01a03a09a08/The-Vampire-Diaries-Staffel-6-by-Emily-Benton.pdf
    • http://muicuiu.dumb1.com/6a06a02a02a01a02/The-Sounds-of-Tomorrow-The-Vampire-Diaries-Commencement-1-by-C-L-Marlene.pdf
    • http://muicuiu.dumb1.com/4a07a09a01a07a07/Breaking-Free-The-Vampire-Diaries-Revelations-1-by-L-Maci.pdf
    • http://muicuiu.dumb1.com/1a09a08a03a09a09/The-Sparkly-Vampire--Obsessed-Diaries-by-Lauren-Fobbs.pdf
    • http://muicuiu.dumb1.com/9a03a03a08a06a04/A-Visitor-s-Guide-to-Mystic-Falls-Your-Favorite-Authors-on-The-Vampire-Diaries-by-Red.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.