Malicious PDF — malware analysis report

Static analysis result for SHA-256 d48eff50aa5ea6bb…

MALICIOUS

PDF

21.7 KB Created: 2019-05-02 17:10:20 +01:00 Authoring application: mPDF 5.7
MD5: e00c314991e5ab9e484a9d85224e35ac SHA-1: 5b163f2a3b01806bdb1dbb6e8ea44c15d97faf85 SHA-256: d48eff50aa5ea6bbb95aea5735223d7527df7303729743dd800e71d58de06786
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of embedded links to external PDF files. The primary attack pattern observed is a link farm designed to direct users to potentially malicious content hosted on the `cmeinasaoo.duckdns.org` domain. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/9b26b22b27b22b21/Doktorspiele-Gest-ndnisse-eines-Hochstaplers-by-Gert-Postel.pdf
    • http://cmeinasaoo.duckdns.org/8b26b20b23b21b26/Der-Mann-der-Rockefeller-war-Aufstieg-und-Fall-eines-bayerischen-Hochstaplers-by-Mark-Seal.pdf
    • http://cmeinasaoo.duckdns.org/7b23b25b26b26b24/Balieff-s-Chauve-Souris-of-Moscow-American-Season-Under-the-Direction-of-F-Ray-Comstock-and-Morris-Gest-by-Teatr-Letuchaia-Mysh-39-.pdf
    • http://cmeinasaoo.duckdns.org/9b20b26b22b27b27/Radikale-Phrase-Wahlb-ndnisse-Und-Kontinuit-ten-Landtagswahlk-mpfe-in-sterreichs-Bundesl-ndern-1919-Bis-1932-by-Herbert-Dachs.pdf
    • http://cmeinasaoo.duckdns.org/1b20b29b27b29b29/The-Populist-Vision-by-Charles-Postel.pdf
    • http://cmeinasaoo.duckdns.org/1b20b24b20b27b27b22/Tabulose-Doktorspiele-Sexs-chtige-Krankenschwester-stellt-sich-als-Lustobjekt-zur-Verf-gung-by-Anna-Herrmanns.pdf
    • http://cmeinasaoo.duckdns.org/1b20b24b22b22b27b21/Die-konstantinische-Wende-Bekehrung-eines-Kaisers-oder-Kalk-l-eines-machtstrategischen-Politikers-by-Patrick-Ziehm.pdf
    • http://cmeinasaoo.duckdns.org/6b25b25b27b21b24/Last-Oasis-Facing-Water-Scarcity-by-Sandra-Postel.pdf
    • http://cmeinasaoo.duckdns.org/9b27b26b22b23b20/Beichte-eines-M-rders-erz-hlt-in-einer-Nacht-Geschichte-eines-Doppelmordes-im-Ersten-Weltkrieg-by-Joseph-Roth.pdf
    • http://cmeinasaoo.duckdns.org/6b25b25b29b20b22/Dividing-the-Waters-Food-Security-Ecosystem-Health-amp-the-New-Politics-Worldwatch-Paper-132-by-Sandra-Postel.pdf
    • http://cmeinasaoo.duckdns.org/9b27b29b26b28b26/Rammstein-by-Gert-Hof.pdf
    • http://cmeinasaoo.duckdns.org/6b26b27b29b26b26/Le-zoo-de-Mengele-by-Gert-Nyg-rdshaug.pdf
    • http://cmeinasaoo.duckdns.org/9b29b25b22b27b29/Geometric-Regional-Novel-by-Gert-Jonke.pdf
    • http://cmeinasaoo.duckdns.org/8b28b29b28b29b22/Images-of-Horror-and-Fantasy-by-Gert-Schiff.pdf
    • http://cmeinasaoo.duckdns.org/1b21b28b24b26b23b22/Die-Schering-AG-in-der-Zeit-des-Nationalsozialismus-by-Gert-Wlasich.pdf
    • http://cmeinasaoo.duckdns.org/9b21b21b22b20b22/The-Blood-Brain-Barrier-BBB-by-Gert-Fricker.pdf
    • http://cmeinasaoo.duckdns.org/1b26b25b24b22b22/The-Stalin-Front-A-Novel-of-World-War-II-by-Gert-Ledig.pdf
    • http://cmeinasaoo.duckdns.org/1b21b29b27b27b23b26/Richtungen-Im-Raum-Interdisziplinare-Perspektiven-by-Gert-Rickheit.pdf
    • http://cmeinasaoo.duckdns.org/9b29b25b20b27b29/The-Skeleton-Speaks-Gert-O-Connell-2-by-Steven-Donkin.pdf
    • http://cmeinasaoo.duckdns.org/7b26b25b20b26/Homage-to-Czerny-Studies-in-Virtuoso-Technique-by-Gert-Jonke.pdf
    • http://cmeinasaoo.duckdns.org/9b20b26b22b27b27/Radikale-Phrase-Wahlb-ndnisse-Und-Kontinuit-ten-Landtagswahlk-mpfe-in-sterreichs-Bundesl-ndern-1919-Bis-1932-by-

Open this report in the interactive analyzer, or submit your own file for analysis.