Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4f149e5e1b3eb76…

MALICIOUS

PDF

20.7 KB Created: 2019-05-03 05:33:30 +01:00 Authoring application: mPDF 5.7
MD5: 1feca08b7cc178cc34681b0ad5574c92 SHA-1: 46293cc5b0ea25156801ddf6a2eb2df168038200 SHA-256: e4f149e5e1b3eb76497ef2948d2ed0b642067f1d2ad9a627b7752d3618c472b6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on the domain 'kiteeearpdf.myhome.cx'. This behavior is indicative of a link farm or a phishing lure designed to redirect users to potentially malicious content. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9924

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/2f215f215f217f210f214/After-Appomattox-How-the-South-Won-the-War-by-Stetson-Kennedy.pdf
    • http://kiteeearpdf.myhome.cx/2f218f211f213f218f213/Unmasked-Volume-Three-Unmasked-3-by-Cassia-Leo.pdf
    • http://kiteeearpdf.myhome.cx/6f219f211f213f217/Unmasked-Volume-Two-Unmasked-2-by-Cassia-Leo.pdf
    • http://kiteeearpdf.myhome.cx/7f210f213f212f218/Unmasked-Volume-One-Unmasked-1-by-Cassia-Leo.pdf
    • http://kiteeearpdf.myhome.cx/1f218f219f211f212f216/Unmasked-Volume-One-Unmasked-1-by-Cassia-Leo.pdf
    • http://kiteeearpdf.myhome.cx/1f218f216f218f215f214/Jacqueline-Kennedy-Historic-Conversations-on-Life-with-John-F-Kennedy-by-Jacqueline-Kennedy-Onassis.pdf
    • http://kiteeearpdf.myhome.cx/3f210f211f211f212f217/Holiday-in-a-Stetson-by-Marie-Ferrarella.pdf
    • http://kiteeearpdf.myhome.cx/2f212f219f219f213f211/The-Devil-in-a-Stetson-by-Lietha-Wards.pdf
    • http://kiteeearpdf.myhome.cx/3f217f214f216f210f210/Santa-In-A-Stetson-by-Janet-Dailey.pdf
    • http://kiteeearpdf.myhome.cx/1f216f211f211f218f216/The-Missing-Kennedy-Rosemary-Kennedy-and-the-Secret-Bonds-of-Four-Women-by-Elizabeth-Koehler-Pentacoff.pdf
    • http://kiteeearpdf.myhome.cx/2f216f210f212f214f214/Kick-Kennedy-The-Charmed-Life-and-Tragic-Death-of-the-Favorite-Kennedy-Daughter-by-Barbara-Leaming.pdf
    • http://kiteeearpdf.myhome.cx/3f213f215f219f218f213/Mrs-Kennedy-The-Missing-History-of-the-Kennedy-Years-by-Barbara-Leaming.pdf
    • http://kiteeearpdf.myhome.cx/4f219f215f214f210f213/Riding-the-Stallion-Stetson-Series-2-by-Candy-Collins.pdf
    • http://kiteeearpdf.myhome.cx/4f210f214f210f213f212/The-Clansman-An-Historical-Romance-of-the-Ku-Klux-Klan-by-Thomas-Dixon-Jr-.pdf
    • http://kiteeearpdf.myhome.cx/1f211f214f212f212f217f213/Jane-Street-of-Gopher-Prarie-by-James-Stetson-Metcalfe.pdf
    • http://kiteeearpdf.myhome.cx/5f211f215f215f219f216/Behind-the-Mask-of-Chivalry-The-Making-of-the-Second-Ku-Klux-Klan-by-Nancy-MacLean.pdf
    • http://kiteeearpdf.myhome.cx/6f210f217f217f211f218/The-Second-Coming-of-the-KKK-The-Ku-Klux-Klan-of-the-1920s-and-the-American-Political-Tradition-by-Linda-Gordon.pdf
    • http://kiteeearpdf.myhome.cx/7f219f215f214f213f215/Gospel-According-to-the-Klan-The-Kkk-s-Appeal-to-Protestant-America-1915-1930-by-Kelly-J-Baker.pdf
    • http://kiteeearpdf.myhome.cx/2f217f219f219f212f213/Murder-at-Broad-River-Bridge-The-Slaying-of-Lemuel-Penn-by-Members-of-the-Ku-Klux-Klan-by-Bill-Shipp.pdf
    • http://kiteeearpdf.myhome.cx/3f215f216f210f212f210/Unmasked-by-R-Saint-Claire.pdf
    • http://kiteeearpdf.myhome.cx/3f217f214f216f210f210/Santa-In-A-Ste

Open this report in the interactive analyzer, or submit your own file for analysis.