Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc658a16c3a2b0f6…

MALICIOUS

PDF

17.2 KB Created: 2019-05-07 09:41:25 +01:00 Authoring application: mPDF 5.7
MD5: 6a689e1905b9e15753d843a760d3197f SHA-1: e2f24e37e37bcf2ff7c93ca724d56499bd9d54b6 SHA-256: dc658a16c3a2b0f619121f9eaf7f2794871e81dd8b281961e5620933d157067e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which point to external PDF files. These links are likely part of a link farm designed to manipulate search engine results or redirect users to malicious content. While no scripts were extracted, the ML_NYX_PDF_MALICIOUS classifier strongly indicates malicious intent. The primary attack pattern involves leveraging these links for traffic redirection or further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a08a06a06a02a07/The-Private-Patient-Adam-Dalgliesh-14-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/2a02a05a03a07a06/Unnatural-Causes-Adam-Dalgliesh-3-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/1a09a01a04a03a01/A-Certain-Justice-Adam-Dalgliesh-10-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/3a04a02a05a08a02/The-Lighthouse-Adam-Dalgliesh-13-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/2a05a01a03a03a04/Cover-Her-Face-Adam-Dalgliesh-1-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/1a07a04a06a06/Shroud-for-a-Nightingale-Adam-Dalgliesh-4-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/3a03a06a03a03a03/Cover-Her-Face-Adam-Dalgliesh-1-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/5a03a02a00a03/Death-in-Holy-Orders-Adam-Dalgliesh-11-by-P-D-James.pdf
    • http://muicuiu.dumb1.com/7a05a09a05a09a05/Private-Gold-Private-13-5-by-James-Patterson.pdf
    • http://muicuiu.dumb1.com/6a08a01a09a02a01/Private-Princess-Private-14-by-James-Patterson.pdf
    • http://muicuiu.dumb1.com/4a03a02a06a05/Private-Private-1-by-James-Patterson.pdf
    • http://muicuiu.dumb1.com/2a08a05a01a06a05/Private-Private-1-by-James-Patterson.pdf
    • http://muicuiu.dumb1.com/3a05a02a03/Private-Rio-Private-11-by-James-Patterson.pdf
    • http://muicuiu.dumb1.com/1a00a07a09a04a09a06/Private-Oz-Private-7-by-James-Patterson.pdf
    • http://muicuiu.dumb1.com/5a08a05a06a08a05/How-to-Become-Patient-How-to-Build-Patience-and-Remove-Impatience-by-James-O-39-Donnell.pdf
    • http://muicuiu.dumb1.com/5a00a03a09a00a03/The-Private-Memoirs-and-Confessions-of-a-Justified-Sinner-by-James-Hogg.pdf
    • http://muicuiu.dumb1.com/3a09a01a06a07a08/The-Private-Memoirs-and-Confessions-of-a-Justified-Sinner-by-James-Hogg.pdf
    • http://muicuiu.dumb1.com/3a08a08a09a00/The-Private-Memoirs-and-Confessions-of-a-Justified-Sinner-by-James-Hogg.pdf
    • http://muicuiu.dumb1.com/4a07a09a08a02a08/GEDLA-ADAM-The-Combat-of-Adam-Against-Satan-The-Book-of-Adam-amp-Eve-by-Ethiopian-Church.pdf
    • http://muicuiu.dumb1.com/4a02a06a02a04a02/The-First-Detective-The-Life-and-Revolutionary-Times-of-Eugene-Vidocq-Criminal-Spy-and-Private-Eye-by-James-Morton.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.