Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4fb73b55fd12ca7…

MALICIOUS

PDF

18.9 KB Created: 2019-04-30 03:33:06 +01:00 Authoring application: mPDF 5.7
MD5: 68b07b41d72bc33c6c1634732cb316f2 SHA-1: 50b4cc0bed26a572821c2530aa93c884abc1c9f6 SHA-256: e4fb73b55fd12ca7f3ac00776cbe632dd90b5044ec347c13c9b6619c09a333a4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. It contains a large number of embedded URLs that form a link farm, likely for SEO manipulation or to distribute further malicious content. While no scripts were extracted, the PDF structure and the heuristic firings strongly suggest a malicious intent to redirect users to potentially harmful external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://unieoooq.linkpc.net/54e94e14e44e34e7/The-Classic-Works-of-J--K-Huysmans-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e34e8/The-Road-from-Decadence-From-Brothel-to-Cloister-Selected-Letters-of-J-K-Huysmans-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e44e1/Oeuvres-de-Joris-Karl-Huysmans-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/24e14e54e54e04e6/L--Bas-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/24e94e84e04e34e6/Against-the-Grain-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/64e34e64e74e44e7/Against-the-Grain-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e24e4/A-Dilemma-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e14e6/Downstream-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/44e14e94e14e04e0/En-Route-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/74e54e94e54e74e2/Against-the-Grain-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e64e2/A-Dish-of-Spices-by-Joris-Karl-Huysmans.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e34e3/What-Is-Politics-by-Jef-Huysmans.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e94e6/Immediacy-amp-Meaning-Jk-Huysmans-amp-the-Immemorial-Origin-of-Metaphysics-by-Caitlin-Smith-Gilson.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e84e2/The-Genius-Of-The-Future-Essays-In-French-Art-Criticism-Diderot-Stendhal-Baudelaire-Zola-The-Brothers-Goncourt-Huysmans-by-Anita-Brookner.pdf
    • http://unieoooq.linkpc.net/54e94e14e44e84e0/Gr-newald-The-Paintings-With-two-essays-by-J-K-Huysmans-and-a-catalogue-by-E-Ruhmer-by-Eberhard-Ruhmer.pdf
    • http://unieoooq.linkpc.net/84e54e44e04e04e6/Reality-And-Illusion-In-The-Novels-Of-J-K-Huysmans-Faux-Titre-24-Faux-Titre-Bd-24-by-Ruth-Antosh.pdf
    • http://unieoooq.linkpc.net/64e14e74e94e34e6/Joris-amp-Joris-on-Vacation-by-Dovani.pdf
    • http://unieoooq.linkpc.net/44e44e34e34e64e2/Alice-s-Adventures-in-Wonderland-and-Other-Classic-Works-by-Lewis-Carroll.pdf
    • http://unieoooq.linkpc.net/14e04e04e14e24e04e7/Karl-Marx-s-Das-Kapital-A-Modern-Day-Interpretation-of-an-Economic-Classic-by-Steve-Shipside.pdf
    • http://unieoooq.linkpc.net/14e14e34e04e94e74e8/Karl-Schmidt-Rottluff-Works-in-the-Kunstsammlungen-Chemnitz-by-Ingrid-M-ssinger.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.