Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7a557697f43f67c…

MALICIOUS

PDF

19.2 KB Created: 2019-05-02 18:31:12 +01:00 Authoring application: mPDF 5.7
MD5: a9c518d78223b4d9e0557e723ed0b96a SHA-1: 83b582a34f138c435b6d1060d6b149d27b652405 SHA-256: d7a557697f43f67cb43e6cab66ac0485e7949dfecb09027d2d961a437249cfe6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier with high confidence and contains a large number of embedded external links. The primary heuristic indicates a 'PDF_SEO_LINK_FARM', suggesting the document's purpose is to host a mass of links, likely for SEO manipulation or to serve as a distribution point for other malicious content. While no scripts were extracted, the structure and link farm heuristic strongly suggest a malicious intent to redirect users or influence search results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/7b25b23b23b26b27/Journey-To-Guyana-by-Margaret-Bacon.pdf
    • http://cmeinasaoo.duckdns.org/7b23b21b22b23b26/Golden-Lads-Sir-Francis-Bacon-Anthony-Bacon-and-Their-Friends-by-Daphne-du-Maurier.pdf
    • http://cmeinasaoo.duckdns.org/6b24b26b22b28b25/Zingerman-s-Guide-to-Better-Bacon-Stories-of-Pork-Bellies-Hush-Puppies-Rock-n-Roll-Music-and-Bacon-Fat-Mayonnaise-by-Ari-Weinzweig.pdf
    • http://cmeinasaoo.duckdns.org/3b26b25b26b27b24/Behind-the-Scenes-Or-Thirty-Years-a-Slave-and-Four-Years-in-the-White-House-by-Elizabeth-Keckley.pdf
    • http://cmeinasaoo.duckdns.org/7b23b23b27b26b21/Behind-the-Scenes-Or-Thirty-Years-a-Slave-and-Four-Years-in-the-White-House-by-Elizabeth-Keckley.pdf
    • http://cmeinasaoo.duckdns.org/4b21b25b27b26b23/Years-of-Sorrow-Years-of-Shame-The-Story-of-the-Japanese-Canadians-in-World-War-II-by-Barry-Broadfoot.pdf
    • http://cmeinasaoo.duckdns.org/9b29b21b27b28b21/1000-Years-of-Sobriety-20-People-x-50-Years-by-William-Borchert.pdf
    • http://cmeinasaoo.duckdns.org/6b20b24b23b28b28/The-Years-Between-The-Heir-of-Buckingham-The-Years-Between-3-by-Paul-F-val-fils.pdf
    • http://cmeinasaoo.duckdns.org/4b24b23b24b22b22/Report-on-a-Journey-to-the-Western-States-of-North-America-and-a-Stay-of-Several-Years-Along-the-Missouri-During-the-Years-1824-25-26-1827-by-Gottfried-Duden.pdf
    • http://cmeinasaoo.duckdns.org/2b20b25b21b27b27/The-Essays-by-Francis-Bacon.pdf
    • http://cmeinasaoo.duckdns.org/3b28b25b25b24b24/Finn-by-Katharine-Jay-Bacon.pdf
    • http://cmeinasaoo.duckdns.org/1b27b25b24b21b28/Life-Before-by-Michele-Bacon.pdf
    • http://cmeinasaoo.duckdns.org/8b28b21b23b20b25/The-Ivy-Years-Collection-The-Ivy-Years-1-3-by-Sarina-Bowen.pdf
    • http://cmeinasaoo.duckdns.org/2b29b21b24b26b27/The-Dominion-Key-Joshua-Dread-3-by-Lee-Bacon.pdf
    • http://cmeinasaoo.duckdns.org/1b20b25b26b20b29b21/Francis-Bacon-by-Michael-Leiris.pdf
    • http://cmeinasaoo.duckdns.org/1b26b25b27b29b27/Fishing-for-Bacon-by-Michael-Davie.pdf
    • http://cmeinasaoo.duckdns.org/4b26b20b27b26b23/Lost-Geography-by-Charlotte-Bacon.pdf
    • http://cmeinasaoo.duckdns.org/8b28b20b22b24b27/101-Things-To-Do-With-Bacon-by-Eliza-Cross.pdf
    • http://cmeinasaoo.duckdns.org/3b23b21b20b28b29/The-Mutt-The-Order-1-by-Kasia-Bacon.pdf
    • http://cmeinasaoo.duckdns.org/8b29b26b27b20b24/Caravaggio-Bacon-by-Claudio-Massimo-Strinati.pdf
    • http://cmeinasaoo.duckdns.org/4b21b25b27b26b23/Years-of-Sorrow-Year

Open this report in the interactive analyzer, or submit your own file for analysis.