Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8b4a14ed3f5c6ab…

MALICIOUS

PDF

22.8 KB Created: 2019-05-01 20:23:36 +01:00 Authoring application: mPDF 5.7
MD5: fc56a198848aabc0bfd990ea7101ad97 SHA-1: a7c90fb7edbec1ea36d85878045a7d875106fa66 SHA-256: d8b4a14ed3f5c6aba853ea16c51bbab255ce47b6b900924d7249fce94e48060f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on the `cmeinasaoo.duckdns.org` domain, indicating a link farm or redirection strategy. The ML classifier strongly flagged this PDF as malicious. While no scripts were extracted, the sheer volume of links and the dynamic DNS domain suggest a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9903

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/5b24b26b21b28b23/Imprimeurs-amp-Libraires-Parisiens-Du-Xvie-Siecle-Fascicule-Breyer-by-Philippe-Renouard.pdf
    • http://cmeinasaoo.duckdns.org/8b25b25b25b28b28/Hotels-Particuliers-Du-Xvie-Siecle-a-Toulouse-by-Remi-Papillault.pdf
    • http://cmeinasaoo.duckdns.org/5b26b25b20b25b20/Transferts-Culturels-Et-Metissages-Amerique-Europe-Xvie-Xxe-Siecle-Cultural-Transfer-America-and-Europe-500-Years-of-Interculturation-by-Laurier-Turgeon.pdf
    • http://cmeinasaoo.duckdns.org/8b21b27b20b20b21/Les-Architectes-Parisiens-Du-Xvii-Ie-Sie-amp-X300-Cle-Dictionnaire-Biographique-Et-Critique-by-Michel-Gallet.pdf
    • http://cmeinasaoo.duckdns.org/5b29b29b29b28b24/Film-Realise-Par-Philippe-de-Broca-Le-Magnifique-L-Homme-de-Rio-Philippe-de-Broca-on-a-Vole-La-Cuisse-de-Jupiter-L-Incorrigible-by-Source-Wikipedia.pdf
    • http://cmeinasaoo.duckdns.org/5b24b26b22b22b25/Histoire-de-Florence-by-Yves-Renouard.pdf
    • http://cmeinasaoo.duckdns.org/7b22b21b20b28b28/Le-Temps-de-L-Espagne-Xvie-Xviie-Siecles-by-Bartolome-Bennassar.pdf
    • http://cmeinasaoo.duckdns.org/5b24b26b21b24b29/Superviseur-des-effets-visuels-pour-le-cin-ma-by-Caroline-Renouard.pdf
    • http://cmeinasaoo.duckdns.org/5b24b26b20b27b27/Adolphe-Renouard-or-Peasant-Life-amp-Political-Clubs-in-France-by-J-Ward.pdf
    • http://cmeinasaoo.duckdns.org/5b24b26b20b28b22/Human-Rights-in-American-Foreign-Policy-From-the-1960s-to-the-Soviet-Collapse-by-Joe-Renouard.pdf
    • http://cmeinasaoo.duckdns.org/7b20b26b21b27b27/Philippe-Lelievre-Peintures-Gravures-Pastels-by-Philippe-Lelievre.pdf
    • http://cmeinasaoo.duckdns.org/9b24b28b20b24b28/Geschiedenis-Der-Nederlandsche-Beroerten-in-de-Xvie-Eeuw-Geschiedenis-Van-Den-Opstand-in-de-Nederlanden-Van-de-Komst-Van-Alva-Tot-Aan-de-Bevrijding-by-Willem-Jan-Frans-Nuyens.pdf
    • http://cmeinasaoo.duckdns.org/5b24b26b20b28b24/The-Conversion-of-Marie-Alphonse-Ratisbonne-1842-by-Marie-Th-odore-Renouard-De-Bussierre.pdf
    • http://cmeinasaoo.duckdns.org/5b23b22b23b26b21/The-Conversion-of-Marie-Alphonse-Ratisbonne-Original-Narrative-of-Baron-Th-odore-de-Bussi-res-by-Marie-Th-odore-Renouard-De-Bussierre.pdf
    • http://cmeinasaoo.duckdns.org/6b22b28b29b20b28/Works-of-Philippe-Paul-comte-de-S-gur-by-Philippe-Paul-de-S-gur.pdf
    • http://cmeinasaoo.duckdns.org/6b21b25b26b22b23/Fin-de-Siecle-Honeybone-4-by-A-J-Llewellyn.pdf
    • http://cmeinasaoo.duckdns.org/6b21b25b26b22b28/L-entreprise-du-21e-si-cle-by-Robert-T-Kiyosaki.pdf
    • http://cmeinasaoo.duckdns.org/8b23b23b24b21b27/Le-crime-du-si-cle-by-Eric-Pilon.pdf
    • http://cmeinasaoo.duckdns.org/8b25b29b28b24b20/Taine-Au-Carrefour-Des-Cultures-Du-Xi-Xe-Si-cle-by-Unknown.pdf
    • http://cmeinasaoo.duckdns.org/6b22b21b23b26b23/Ce-Siecle-Avait-Deux-ANS-by-Andre-Gillois.pdf
    • http://cmeinasaoo.duckdns.org/8b21b27b20b20b21/Les-Architectes-Parisiens-Du-Xvii-Ie-Sie-amp-X300-Cl

Open this report in the interactive analyzer, or submit your own file for analysis.