Malicious PDF — malware analysis report

Static analysis result for SHA-256 db5d69f8bdb73f70…

MALICIOUS

PDF

19.1 KB Created: 2019-05-01 17:42:27 +01:00 Authoring application: mPDF 5.7
MD5: e2ae1b397d12c4e7b905d218721f70b0 SHA-1: 7f7e653cc557cc21384ad3220b5028b3d4d27acb SHA-256: db5d69f8bdb73f70f0f899fc4505aecd7ca1d3a51f98bca0bf7574b4ad5260d0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While many of these links resolve to benign content, the sheer volume and the ML classifier's high confidence score suggest a malicious intent, likely for SEO manipulation or to distribute further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/6209200200209/Until-Death-Do-Us-Part-Omnibus-2-in-1-Edition-Vol-1-Includes-Vol-1-amp-2-Until-Death-Do-Us-Part-Omnibus-1-by-Hiroshi-Takashige.pdf
    • http://xiixmcuin.linkpc.net/5200205204202205/Until-Death-Do-Us-Part-Omnibus-2-in-1-Edition-Vol-4-Includes-Vol-7-amp-8-Until-Death-Do-Us-Part-Omnibus-4-by-Hiroshi-Takashige.pdf
    • http://xiixmcuin.linkpc.net/3205201202208205/Until-Death-Do-Us-Part-Vol-1-by-Hiroshi-Takashige.pdf
    • http://xiixmcuin.linkpc.net/2200202205202204/Ghost-Bird-The-Academy-Omnibus-Part-2-Books-Five---Eight-by-C-L-Stone.pdf
    • http://xiixmcuin.linkpc.net/5200203203201201/The-Death-of-Captain-America-Omnibus-by-Ed-Brubaker.pdf
    • http://xiixmcuin.linkpc.net/2208207200207202/Omnibus-A-Mind-To-Murder-A-Taste-For-Death-Devices-And-Desires-by-P-D-James.pdf
    • http://xiixmcuin.linkpc.net/2201203205202204/Omnibus-Shroud-For-A-Nightingale-The-Black-Tower-Death-Of-An-Expert-Witness-by-P-D-James.pdf
    • http://xiixmcuin.linkpc.net/3201200207/-Til-Death-Do-Us-Part-by-Amanda-Quick.pdf
    • http://xiixmcuin.linkpc.net/4204204205202202/Death-Day-Part-One-by-Samuel-Hiti.pdf
    • http://xiixmcuin.linkpc.net/2207200205204205/--2--Jojo-no-kimy-na-b-ken-2-sent-ch-ry-s-sh-hen-shimo-Jojo-s-Bizarre-Adventure-Part-2-Battle-Tendency-2-of-2-Omnibus-3-by-Hirohiko-Araki.pdf
    • http://xiixmcuin.linkpc.net/1207204200207202/For-Richer-or-For-Poorer-Til-Death-Us-Do-Part-5-by-Krissy-V-.pdf
    • http://xiixmcuin.linkpc.net/9205205206209/Till-Death-Do-Us-Part-by-Dennis-E-Adonis.pdf
    • http://xiixmcuin.linkpc.net/6201203206201206/Sickness-Unto-Death-Part-2-by-Hikari-Asada.pdf
    • http://xiixmcuin.linkpc.net/4203200209201207/Until-Death-Do-Us-Part-Kismet-Knight-1-5-by-Lynda-Hilburn.pdf
    • http://xiixmcuin.linkpc.net/1200208208204200202/Death-Do-Us-Part-Damen-Brook-6-by-Steven-Dunne.pdf
    • http://xiixmcuin.linkpc.net/2201209200205203/-Til-Death-Do-Us-Part-Lily-Drake-2-by-T-Michelle-Nelson.pdf
    • http://xiixmcuin.linkpc.net/2202206201202204/Till-Death-Do-Us-Part-Bis-dass-der-Tod-uns-scheidet-by-Kendra-North.pdf
    • http://xiixmcuin.linkpc.net/3206206202206209/Some-Other-Dusk-A-romantic-comedy-that-even-death-may-not-part-by-Renata-M-Cardoso.pdf
    • http://xiixmcuin.linkpc.net/8203201207202/Till-Death-Do-Us-Part-April-Lancaster-1-by-Lurlene-McDaniel.pdf
    • http://xiixmcuin.linkpc.net/4209202202208203/Till-Death-Do-Us-Part-Dr-Gideon-Fell-15-by-John-Dickson-Carr.pdf
    • http://xiixmcuin.linkpc.net/2201203205202204/Omnibus-Shroud-For-A-Nighting

Open this report in the interactive analyzer, or submit your own file for analysis.