Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7aa01dc1327f75d…

MALICIOUS

PDF

16.6 KB Created: 2019-05-04 13:51:48 +01:00 Authoring application: mPDF 5.7
MD5: 1f9c41b8484d292d2f8bc9073eaa5794 SHA-1: ecc25f337d3b48e6ba8ba8441b77445e8963a17b SHA-256: d7aa01dc1327f75df15d3a088f92767a30564f08295d53a078b3a52047ca2753
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains a large number of embedded URLs pointing to external PDF files, hosted on the dynamic DNS domain 'xiixmcuin.linkpc.net'. This behavior is indicative of a link farm or a redirection scheme designed to lead users to potentially malicious content. The ML classifier strongly supports the malicious verdict, and the PDF_SEO_LINK_FARM heuristic confirms the presence of numerous external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9913

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/1200203204209201205/Tanner-s-Lemming-by-John-Whitlatch.pdf
    • http://xiixmcuin.linkpc.net/8202202203203207/A-Narrative-of-the-Captivity-and-Adventures-of-John-Tanner-U-S-Interpreter-at-the-Saut-de-Ste-Marie-During-Thirty-Years-Residence-Among-the-Indians-in-the-Interior-of-North-America-by-John-Tanner.pdf
    • http://xiixmcuin.linkpc.net/6200207207204204/Angelus-Britannicus-An-Ephemeris-for-the-Year-of-Our-Redemption-1710-by-John-Tanner-by-John-Tanner.pdf
    • http://xiixmcuin.linkpc.net/3202200205200200/Whiz-Tanner-and-the-Wounded-Pigeon-Tanner-Dent-Mysteries-6-by-Fred-Rexroad.pdf
    • http://xiixmcuin.linkpc.net/1201200208209204206/Tanner-s-Twelve-Swingers-Evan-Tanner-3-by-Lawrence-Block.pdf
    • http://xiixmcuin.linkpc.net/1201200208209204203/Will-Tanner-U-S-Deputy-Marshal-Will-Tanner-1-by-William-W-Johnstone.pdf
    • http://xiixmcuin.linkpc.net/4202209206207/Ellipsis-John-Marshall-Tanner-14-by-Stephen-Greenleaf.pdf
    • http://xiixmcuin.linkpc.net/1201206208200207206/Toll-Call-John-Marshall-Tanner-6-by-Stephen-Greenleaf.pdf
    • http://xiixmcuin.linkpc.net/1201200208209204202/Two-For-Tanner-Evan-Tanner-4-by-Lawrence-Block.pdf
    • http://xiixmcuin.linkpc.net/1205205200207206/The-Weller-by-Adam-J-Whitlatch.pdf
    • http://xiixmcuin.linkpc.net/9200205208201/Mormon-Mother-An-Autobiography-by-Annie-Clark-Tanner-by-Annie-C-Tanner.pdf
    • http://xiixmcuin.linkpc.net/1201207204205200205/The-Year-Of-The-Lemming-A-Novel-by-Rob-Same.pdf
    • http://xiixmcuin.linkpc.net/1200203204209200205/The-Lemming-Condition-by-Alan-Arkin.pdf
    • http://xiixmcuin.linkpc.net/1200203205200201209/The-Flaming-Lemming-by-Matt-Szychowski.pdf
    • http://xiixmcuin.linkpc.net/1200203205200203200/Larry-The-Lemming-by-Clive-Woodall.pdf
    • http://xiixmcuin.linkpc.net/1200203205200202200/The-Lemming-Folk-by-James-Gibb-Stuart.pdf
    • http://xiixmcuin.linkpc.net/1200203205200202201/The-Lemming-Factor-by-MR-Kimbell-Richard-Vincent.pdf
    • http://xiixmcuin.linkpc.net/1201207204205200206/eddie-the-nomadic-lemming-by-Edward-Butcher.pdf
    • http://xiixmcuin.linkpc.net/1200203204209209200/Robert-and-the-Lemming-Problem-by-Barbara-Seuling.pdf
    • http://xiixmcuin.linkpc.net/1201207204205201208/The-Lemming-with-the-Locket-Uncle-Scrooge-104-by-Walt-Disney-Company.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.