Malicious PDF — malware analysis report

Static analysis result for SHA-256 da56f937c2b6e5a9…

MALICIOUS

PDF

16.1 KB Created: 2019-04-30 05:25:50 +01:00 Authoring application: mPDF 5.7
MD5: 8883120cd93c9c473767956b49f795a6 SHA-1: 0af738ee53e249d1c0c00e1c750565bcba6b44d6 SHA-256: da56f937c2b6e5a99d0cb9686a278dde433bbe4770211d87449fbdf31e2d4400
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded URLs, identified as a link farm. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the sheer volume of links suggests a tactic to drive traffic to potentially malicious sites or for SEO poisoning. The primary attack pattern involves redirecting users through these numerous external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.co
    • http://muicuiu.dumb1.com/2a05a09a03a02a00/Wings-of-Darkness-The-Immortal-Sorrows-1-by-Sherri-A-Wingler.pdf
    • http://muicuiu.dumb1.com/2a01a03a08a02a03/Wings-of-Darkness-The-Immortal-Sorrows-1-by-Sherri-A-Wingler.pdf
    • http://muicuiu.dumb1.com/8a08a03a03a02a06/Rhino-The-Immortal-Phantom-Ii-Wings-No-6-by-Joe-Cupido.pdf
    • http://muicuiu.dumb1.com/8a00a07a09a04/Colorado-Wings-A-Wing-and-a-Prayer-Wings-Like-Eagles-Wings-of-the-Dawn-A-Gift-of-Wings-by-Tracie-Peterson.pdf
    • http://muicuiu.dumb1.com/3a01a08a01a03a03/Blade-of-the-Immortal-Volume-4-On-Silent-Wings-by-Hiroaki-Samura.pdf
    • http://muicuiu.dumb1.com/3a01a08a01a03a07/Blade-of-the-Immortal-Volume-5-On-Silent-Wings-II-by-Hiroaki-Samura.pdf
    • http://muicuiu.dumb1.com/6a01a01a03/Darkness-of-Dragons-Wings-of-Fire-10-by-Tui-T-Sutherland.pdf
    • http://muicuiu.dumb1.com/1a08a08a09a08a00/Born-to-Darkness-Immortal-Destiny-1-by-Lorraine-Kennedy.pdf
    • http://muicuiu.dumb1.com/2a09a00a02a01a05/Darkness-Falls-Immortal-Beloved-2-by-Cate-Tiernan.pdf
    • http://muicuiu.dumb1.com/3a08a00a01a07a05/Bound-in-Darkness-Immortal-Brothers-4-by-Jacquelyn-Frank.pdf
    • http://muicuiu.dumb1.com/1a08a09a04a08a03/Darkness-Dawns-Immortal-Guardians-1-by-Dianne-Duvall.pdf
    • http://muicuiu.dumb1.com/2a04a08a08a04a09/Edge-of-Darkness-Dark-23-5-Wings-in-the-Night-Reborn-1-5-by-Christine-Feehan.pdf
    • http://muicuiu.dumb1.com/4a05a07a09a03a05/Eternal-Love-The-Immortal-Witch-Series-Immortal-Witches-1-2-amp-3-by-Maggie-Shayne.pdf
    • http://muicuiu.dumb1.com/7a00a04a00a07/Arielle-Immortal-Fury-Immortal-Rapture-6-by-Lilian-Roberts.pdf
    • http://muicuiu.dumb1.com/1a02a07a01a02a00/Immortal-Bound-Amele-Immortal-Dreams-2-by-Jennifer-Sage.pdf
    • http://muicuiu.dumb1.com/1a00a01a09a05a00/Arielle-Immortal-Journey-Immortal-Rapture-5-by-Lilian-Roberts.pdf
    • http://muicuiu.dumb1.com/1a09a08a04a09a03/Arielle-Immortal-Awakening-Immortal-Rapture-1-by-Lilian-Roberts.pdf
    • http://muicuiu.dumb1.com/1a02a02a01a05a00/Immortal-Outlaw-Immortal-Brotherhood-2-by-Lisa-Hendrix.pdf
    • http://muicuiu.dumb1.com/3a05a06a07a01a08/Immortal-Blood-Immortal-Heart-1-by-Magen-McMinimy.pdf
    • http://muicuiu.dumb1.com/1a08a08a00a03a04/Immortal-of-My-Heart-Immortal-Series-2-by-Alexis-McNeil.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.