Malicious PDF — malware analysis report

Static analysis result for SHA-256 d908d2912b6286d9…

MALICIOUS

PDF

19.9 KB Created: 2019-05-07 03:29:02 +01:00 Authoring application: mPDF 5.7
MD5: 25284b8a282f680c0ddd96b7ec97e8b9 SHA-1: e990136664d7693637b40f4869c9d4c5388d4599 SHA-256: d908d2912b6286d960050b9ad8d7653e85308b901d646b8d94be491e83eb57ae
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign-looking book titles, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO spam or to redirect users to harmful sites. The ML_NYX_PDF_MALICIOUS classifier also strongly supports a malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9924

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a01a05a06a03a02a01/Global-Trends-Shaping-The-Workplace-Of-Tomorrow-C-By-Maureen-Minehan-Nathaniel-M-Semple-William-T-Semple-by-Maureen-Minehan.pdf
    • http://muicuiu.dumb1.com/1a05a00a05a05a05/Storm-Coming-A-Novel-of-the-Civil-War-in-Western-Virginia-Children-of-the-Storm-1-by-Jack-W-Lewis.pdf
    • http://muicuiu.dumb1.com/2a05a04a09a09a07/Storm-Coming-A-Novel-of-the-Civil-War-in-Western-Virginia-Children-of-the-Storm-1-by-Jack-W-Lewis.pdf
    • http://muicuiu.dumb1.com/6a06a02a06/The-Storm-Before-the-Storm-The-Beginning-of-the-End-of-the-Roman-Republic-by-Mike-Duncan.pdf
    • http://muicuiu.dumb1.com/2a08a04a08a03a02/A-Brewing-Storm-Derrick-Storm-1-by-Richard-Castle.pdf
    • http://muicuiu.dumb1.com/6a04a02a05a01a01/Wild-Storm-Derrick-Storm-5-by-Richard-Castle.pdf
    • http://muicuiu.dumb1.com/3a02a07a04a03a03/Three-German-Classics-A-Village-Romeo-amp-Juliet---Gottfried-Keller-Immensee---Theodore-Storm-Lenz---Georg-Buchner-by-Theodor-Storm.pdf
    • http://muicuiu.dumb1.com/2a00a05a04a01a04/Storm-Warnings-by-Marissa-Storm.pdf
    • http://muicuiu.dumb1.com/2a00a08a01a06a08/Jim-Butcher-s-The-Dresden-Files-Storm-Front-Volume-1-The-Gathering-Storm-by-Jim-Butcher.pdf
    • http://muicuiu.dumb1.com/6a02a06a04a00/The-Witch-of-Salt-and-Storm-Salt-amp-Storm-1-by-Kendall-Kulper.pdf
    • http://muicuiu.dumb1.com/1a04a06a09a02a05/After-the-Storm-Storm-1-by-M-Stratton.pdf
    • http://muicuiu.dumb1.com/5a01a08a03a02/Storm-Siren-Storm-Siren-1-by-Mary-Weber.pdf
    • http://muicuiu.dumb1.com/1a07a03a05a08a07/Salt-amp-Storm-Salt-amp-Storm-1-by-Kendall-Kulper.pdf
    • http://muicuiu.dumb1.com/1a05a06a02a02a08/The-Coming-Storm-The-Coming-Storm-1-by-Valerie-Douglas.pdf
    • http://muicuiu.dumb1.com/2a07a06a05a08a09/Whatever-You-Like-by-Maureen-Smith.pdf
    • http://muicuiu.dumb1.com/4a01a04a09a06a08/Like-No-One-Else-by-Maureen-Smith.pdf
    • http://muicuiu.dumb1.com/3a05a08a05a07a02/And-What-If-I-Won-t-by-Maureen-Fergus.pdf
    • http://muicuiu.dumb1.com/5a00a05a08a06/Beyond-Beyond-1-by-Maureen-A-Miller.pdf
    • http://muicuiu.dumb1.com/1a09a01a08a01a04/The-Convent-by-Maureen-McCarthy.pdf
    • http://muicuiu.dumb1.com/2a06a06a04a02a04/A-Dream-Come-True-by-Maureen-Lee.pdf
    • http://muicuiu.dumb1.com/6a06a02a06/The-Storm-Before-the-Storm-The-Beginning-of-the-End-of-the-Roman-Republ

Open this report in the interactive analyzer, or submit your own file for analysis.