Malicious PDF — malware analysis report

Static analysis result for SHA-256 defcbb42ded5857e…

MALICIOUS

PDF

18.3 KB Created: 2020-03-14 17:32:44 +00:00 Authoring application: mPDF 5.7
MD5: 79d6b99f60f8dbd99d1dc623a3fe34a4 SHA-1: af70ff7853e39d5ccfb37cd3839e7c38095cf79e SHA-256: defcbb42ded5857e9e79aa58ac28fc1796c166d6ddbdd578a0f01fe832aa4d3b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to a single domain, indicative of a link farm designed to lure users to malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this pattern. No scripts were extracted, and the document body was heavily obfuscated, but the primary attack pattern is clear from the URL structure and heuristic firings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tanceubio.myhome.cx/33d33d73d73d43d0/Crow-Episode-One-Crow-1-by-Alex-Owens.pdf
    • http://tanceubio.myhome.cx/23d63d43d63d43d6/The-Johnny-Crow-Omnibus-Featuring-Johnny-Crow-s-Garden-Johnny-Crow-s-Party-and-Johnny-Crow-s-New-Garden-by-L-Leslie-Brooke.pdf
    • http://tanceubio.myhome.cx/53d13d43d23d43d3/Counting-Coup-Becoming-a-Crow-Chief-on-the-Reservation-and-Beyond-by-Joseph-Medicine-Crow.pdf
    • http://tanceubio.myhome.cx/13d23d03d63d0/Eyes-of-Crow-Aspect-of-Crow-1-by-Jeri-Smith-Ready.pdf
    • http://tanceubio.myhome.cx/93d73d63d83d0/Crow-Dog-Four-Generations-of-Sioux-Medicine-Men-by-Leonard-Crow-Dog.pdf
    • http://tanceubio.myhome.cx/13d03d03d93d83d13d3/Eeny-Meeny-Criminy-Crow-Can-a-crow-predict-murder-Which-Criss-Cross-County-residents-will-die-before-the-year-is-over-by-Julie-C-Eger.pdf
    • http://tanceubio.myhome.cx/23d23d63d63d33d5/Scare-Crow-Crow-s-Row-2-by-Julie-Hockley.pdf
    • http://tanceubio.myhome.cx/13d93d93d13d53d6/Crow-s-Row-Crow-s-Row-1-by-Julie-Hockley.pdf
    • http://tanceubio.myhome.cx/23d23d63d43d8/Crow-s-Row-Crow-s-Row-1-by-Julie-Hockley.pdf
    • http://tanceubio.myhome.cx/13d73d73d23d23d7/Dragon-amp-Crow-2-Dojo-Boys-3-by-Alex-A-Akira.pdf
    • http://tanceubio.myhome.cx/93d43d33d03d43d9/Titus-Crow-The-Burrowers-Beneath-the-Transition-of-Titus-Crow-by-Brian-Lumley.pdf
    • http://tanceubio.myhome.cx/93d13d53d23d93d9/No-Cage-for-a-Crow-Part-Three-Ghosts-of-the-Past-No-Cage-for-a-Crow-3-by-Morrigan-Holmes.pdf
    • http://tanceubio.myhome.cx/53d43d43d13d33d4/The-Great-Gatsby-F-Scott-Fitzgerald-Anne-Crow-by-Anne-Crow.pdf
    • http://tanceubio.myhome.cx/13d63d83d43d1/The-Eyes-of-Willie-McGee-A-Tragedy-of-Race-Sex-and-Secrets-in-the-Jim-Crow-South-by-Alex-Heard.pdf
    • http://tanceubio.myhome.cx/23d33d53d73d63d9/The-Storm-Crow-The-Storm-Crow-1-by-Kalyn-Josephson.pdf
    • http://tanceubio.myhome.cx/13d93d53d53d73d1/Crow-Moon-Crow-Moon-1-by-Anna-McKerrow.pdf
    • http://tanceubio.myhome.cx/33d93d13d13d43d7/One-Crow-Alone-by-S-D-Crockett.pdf
    • http://tanceubio.myhome.cx/43d73d33d43d43d9/Pig-and-Crow-by-Kay-Chorao.pdf
    • http://tanceubio.myhome.cx/33d43d83d33d93d0/Six-by-James-Crow.pdf
    • http://tanceubio.myhome.cx/83d73d53d53d4/The-Lion-and-the-Crow-by-Eli-Easton.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.