Malicious PDF — malware analysis report

Static analysis result for SHA-256 d713b60b79aa578d…

MALICIOUS

PDF

19.6 KB Created: 2020-03-18 21:14:13 +00:00 Authoring application: mPDF 5.7
MD5: 81dc979561c5c3d8d2433f2a28ab8a09 SHA-1: bb6a3c2e3fb46c74865498abc4a76fc8a91029ad SHA-256: d713b60b79aa578d345488dce574e6261c1278128b4898466adeef3d4b91d83e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the sheer volume of links points to a malicious intent, likely to distribute malware or phish users. The primary IOCs are the numerous external URLs embedded within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://laoieoa.myhome.cx/3c09c08c08c07c09/The-Soldier-Spies-Men-At-War-3-by-W-E-B-Griffin.pdf
    • http://laoieoa.myhome.cx/1c04c03c08c09c02/The-Honor-of-Spies-Honor-Bound-5-by-W-E-B-Griffin.pdf
    • http://laoieoa.myhome.cx/1c06c02c00c00c00/The-Super-Spies-and-the-High-School-Bomber-Super-Spies-2-by-Lisa-Orchard.pdf
    • http://laoieoa.myhome.cx/1c05c07c03c07c00/Griffin-s-Destiny-Griffin-s-Daughter-Trilogy-3-by-Leslie-Ann-Moore.pdf
    • http://laoieoa.myhome.cx/2c03c09c05c09c06/Griffin-s-Shadow-Griffin-s-Daughter-Trilogy-2-by-Leslie-Ann-Moore.pdf
    • http://laoieoa.myhome.cx/1c00c06c03c04c01c09/Griffin-s-Storm-Griffin-3-by-Darby-Karchut.pdf
    • http://laoieoa.myhome.cx/3c00c02c07c06/Griffin-s-Fire-Griffin-2-by-Darby-Karchut.pdf
    • http://laoieoa.myhome.cx/6c04c00c07c06/Soldier-In-The-Yellow-Socks-Charles-Upham---Our-Finest-Fighting-Soldier-by-Janice-Marriott.pdf
    • http://laoieoa.myhome.cx/1c01c07c02c09c01/A-Soldier-s-Promise-The-Heroic-True-Story-of-an-American-Soldier-and-an-Iraqi-Boy-by-Daniel-Hendrex.pdf
    • http://laoieoa.myhome.cx/3c02c02c02c02c01/The-Soldier-and-the-State-Trooper-The-Soldier-and-1-by-Cherie-Noel.pdf
    • http://laoieoa.myhome.cx/3c07c08c02c01c00/Dreaming-Reality-How-Dreaming-Keeps-Us-Sane-or-Can-Drive-Us-Mad-Joe-Griffin-amp-Ivan-Tyrrell-by-Joe-Griffin.pdf
    • http://laoieoa.myhome.cx/5c00c01c07c01c06/Official-Book-Club-Selection-A-Memoir-According-to-Kathy-Griffin-by-Kathy-Griffin.pdf
    • http://laoieoa.myhome.cx/1c01c00c01c06c06/The-Unexpected-Enlightenment-of-Rachel-Griffin-Rachel-Griffin-1-by-L-Jagi-Lamplighter.pdf
    • http://laoieoa.myhome.cx/2c07c03c00c07c02/In-the-Arms-of-a-Soldier-Soldier-3-by-Makenna-Jameison.pdf
    • http://laoieoa.myhome.cx/5c03c00c03c09c04/Decorating-With-Decoupage-Handmade-Gifts-And-Accessories-Using-Anna-Griffin-s-New-Decoupe-Papers-A-Step-By-Step-Guide-To-Creating-Over-42-Easy-To-Make-Projects-by-Anna-Griffin.pdf
    • http://laoieoa.myhome.cx/3c05c00c06c08c04/The-Griffin-Mage-Trilogy-Griffin-Mage-1-3-by-Rachel-Neumeier.pdf
    • http://laoieoa.myhome.cx/2c08c09c08c01c04/Griffin-s-Daughter-Griffin-s-Daughter-Trilogy-1-by-Leslie-Ann-Moore.pdf
    • http://laoieoa.myhome.cx/1c06c01c03c04c05/Griffin-s-Daughter-Griffin-s-Daughter-Trilogy-1-by-Leslie-Ann-Moore.pdf
    • http://laoieoa.myhome.cx/1c02c03c02c07c05/The-Flight-of-the-Griffin-The-Flight-of-the-Griffin-1-by-C-M-Gray.pdf
    • http://laoieoa.myhome.cx/2c07c04c06c04c05/City-of-Spies-by-Susan-Kim.pdf
    • http://laoieoa.myhome.cx/1c01c07c02c09c01/A-Soldier-s-

Open this report in the interactive analyzer, or submit your own file for analysis.