Malicious PDF — malware analysis report

Static analysis result for SHA-256 df0b89ad49f93e22…

MALICIOUS

PDF

19.6 KB Created: 2020-03-12 22:26:49 +00:00 Authoring application: mPDF 5.7
MD5: bd8312f04096656ac502622213f154dd SHA-1: 8c3955ff3356eaf318cfd1040649a47dd32a12d9 SHA-256: df0b89ad49f93e228789d43d6b542428cd57a124b88af490b8b268a63f8e7a98
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, a technique often used for SEO poisoning to lure users to malicious sites. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the sheer volume of links suggests a redirection or download attempt is the primary goal.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/4f217f214f218f210f212/Pride-and-Prejudice-A-Novel-In-Three-Volumes-Annotated-and-Restored-to-1813-Egerton-First-Edition-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/6f217f213f212f216f211/PRIDE-AND-PREJUDICE-Jane-Austen-author-of-Mansfield-Park-Persuasion-Sense-and-Sensibility-Northanger-Pride-and-Prejudice-Annotated-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/1f211f217f217f211f210f216/NORTHANGER-ABBEY---JANE-AUSTEN-Author-of-Mansfield-Park-Persuasion-Sense-and-Sensibility-Northanger-Pride-and-Prejudice-Annotated-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/1f211f217f216f219f213f217/Jane-Austen-Collection-Seven-Novels-in-One-Pride-and-Prejudice-Persuasion-Mansfield-Park-Northanger-Abbey-Sense-and-Sensibility-Emma-Lady-Susan-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/1f211f217f216f219f212f218/Jane-Austen-Pride-and-Prejudice---Northanger-Abbey---Persuasion-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/2f217f216f212f214f215/Lydia-Bennet-s-Story-A-Sequel-to-Jane-Austen-s-Pride-and-Prejudice-by-Jane-Odiwe.pdf
    • http://kiteeearpdf.myhome.cx/3f218f219f218f217f215/Pride-and-Prejudice-and-Kitties-A-Cat-Lover-s-Romp-through-Jane-Austen-s-Classic-by-Pamela-Jane.pdf
    • http://kiteeearpdf.myhome.cx/9f211f216f212f212f216/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/5f217f210f213f211f216/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/3f219f214f214f210f214/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/5f212f218f216f216f217/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/5f218f218f210f211f216/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/9f218f214f210f215f215/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/4f213f218f213f212f211/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/6f212f215f214f216f216/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/3f212f213f213f216f219/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/3f214f219f213f210f211/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/5f216f211f216f216f210/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/6f214f215f213f219f214/Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/4f211f218f211f219f218/Pride-amp-Prejudice-by-Jane-Austen.pdf
    • http://kiteeearpdf.myhome.cx/1f211f217f217f211f210f216/NORTHANGER-ABBEY---JANE-AUSTEN-Author-of-Mansfield-Park-Persuasion-Sens

Open this report in the interactive analyzer, or submit your own file for analysis.