Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6b2cdd052adc778…

MALICIOUS

PDF

28.5 KB Created: 2019-05-03 07:06:14 +01:00 Authoring application: mPDF 5.7
MD5: 35680a9766417e912bb77b2ef6017552 SHA-1: 0f512d510f364b7d964cd81d0cfd3cf001b325e8 SHA-256: e6b2cdd052adc7780a8c6db5a818f1bc9b5da3290d006316880940e527dc12df
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The primary function appears to be hosting a link farm, likely to redirect users to malicious content or for SEO manipulation. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9908

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/1f210f215f215f213f214f217/Demolition-Means-Progress-Flint-Michigan-and-the-Fate-of-the-American-Metropolis-by-Andrew-R-Highsmith.pdf
    • http://kiteeearpdf.myhome.cx/6f215f210f213f212f211/Biennial-Report-of-the-Board-of-Trustees-of-the-Michigan-State-Sanatorium-and-the-Central-Michigan-Sanatorium-for-the-Treatment-of-Tuberculosis-Howell-Michigan-by-Michigan-State-Sanatorium.pdf
    • http://kiteeearpdf.myhome.cx/3f213f213f212f217f216/Love-Means-Renewal-Love-Means-Series-by-Andrew-Grey.pdf
    • http://kiteeearpdf.myhome.cx/1f216f214f212f211/Beautiful-Shadow-A-Life-of-Patricia-Highsmith-by-Andrew-Wilson.pdf
    • http://kiteeearpdf.myhome.cx/3f213f212f210f212f210/Love-Means-Patience-by-Andrew-Grey.pdf
    • http://kiteeearpdf.myhome.cx/9f219f210f219f212f215/Idlewild-and-Woodland-Park-Michigan-an-African-American-Remembers-by-Rose-Louise-Hammond.pdf
    • http://kiteeearpdf.myhome.cx/3f215f213f214f212f214/A-City-So-Grand-The-Rise-of-an-American-Metropolis-Boston-1850-1900-by-Stephen-Puleo.pdf
    • http://kiteeearpdf.myhome.cx/6f213f215f216f211f212/The-Monied-Metropolis-New-York-City-and-the-Consolidation-of-the-American-Bourgeoisie-1850-1896-by-Sven-Beckert.pdf
    • http://kiteeearpdf.myhome.cx/1f211f213f212f218f216f217/P-Michigan-Koenen-P-Mich-XVIII-Michigan-Texts-Published-in-Honor-of-Ludwig-Koenen-by-Traianos-Gagos.pdf
    • http://kiteeearpdf.myhome.cx/8f214f216f210/The-Poisoned-City-Flint-s-Water-and-the-American-Urban-Tragedy-by-Anna-Clark.pdf
    • http://kiteeearpdf.myhome.cx/3f217f210f215f213f218/Wrestling-with-Moses-How-Jane-Jacobs-Took-On-New-York-s-Master-Builder-and-Transformed-the-American-City-by-Anthony-Flint.pdf
    • http://kiteeearpdf.myhome.cx/1f210f215f216f215f217/Wrestling-with-Moses-How-Jane-Jacobs-Took-On-New-York-s-Master-Builder-and-Transformed-the-American-City-by-Anthony-Flint.pdf
    • http://kiteeearpdf.myhome.cx/9f210f212f211f210f218/The-Origin-Progress-and-Difficulties-of-the-Achill-Mission-As-Detailed-in-the-Minutes-of-Evidence-Taken-Before-the-Select-Committee-of-the-House-of-Lords-Appointed-to-Inquire-Into-the-Progress-and-Operation-of-the-New-Plan-of-Education-in-Ireland-And-by-Edward-Nangle.pdf
    • http://kiteeearpdf.myhome.cx/3f212f217f211f214f216/Progress-Progress-1-by-Amalie-Silver.pdf
    • http://kiteeearpdf.myhome.cx/1f211f214f212f215f210f212/Sons-of-Camelot-The-Fate-of-an-American-Dynasty-by-Laurence-Leamer.pdf
    • http://kiteeearpdf.myhome.cx/6f210f215f217f215f215/The-Means-of-the-Perpetuity-and-Prosperity-of-Our-Republic-An-Oration-Delivered-by-Request-of-the-Municipal-Authorities-of-the-City-of-Boston-July-4-1838-in-the-Old-South-Church-in-Celebration-of-American-Independance-by-Hubbard-Winslow.pdf
    • http://kiteeearpdf.myhome.cx/3f218f216f218f219f214/The-Selected-Stories-of-Patricia-Highsmith-by-Patricia-Highsmith.pdf
    • http://kiteeearpdf.myhome.cx/4f215f210f219f210/Where-White-Men-Fear-to-Tread-The-Autobiography-of-Russell-Means-by-Russell-Means.pdf
    • http://kiteeearpdf.myhome.cx/4f211f214f214f211/The-American-Boy-by-Andrew-Taylor.pdf
    • http://kiteeearpdf.myhome.cx/1f217f218f218f212/American-Countryside-by-Andrew-McCrea.pdf
    • http://kiteeearpdf.myhome.cx/9f219f210f219f212f215/Idlewild-and-Woodland-Park-Michigan-an-African-American-Remembers-by-Rose-Louise-Ham

Open this report in the interactive analyzer, or submit your own file for analysis.