Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8dcd26b15e53dd2…

MALICIOUS

PDF

20.8 KB Created: 2019-05-02 02:15:10 +01:00 Authoring application: mPDF 5.7
MD5: f55278003f082f4596fe27c9d82ca0ef SHA-1: f36f45d17b5f1f7ef9f482688f0a294a718745ef SHA-256: e8dcd26b15e53dd2764e9023bc89a46e665cb2a0682293fcac3939a1ded879a0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. While many of these links resolve to benign content, the sheer volume and the ML_NYX_PDF_MALICIOUS classification suggest a malicious intent, likely to manipulate search engine results or redirect users to harmful sites. The DOC BODY section contains obfuscated text and URLs, further supporting the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://unieoooq.linkpc.net/14e14e84e94e94e14e4/The-Small-House-at-Allington-by-Anthony-Trollope-Complete-Volume-1-and-2-Illustrated-Sir-John-Everett-Millais-1st-Baronet-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/14e14e84e94e94e04e9/Phineas-Finn-the-Irish-Member-a-Novel-by-Anthony-Trollope-in-Two-Volume-Illustrated-by-Sir-John-Everett-Millais-1st-Baronet-Pra-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/24e74e04e14e44e4/The-Short-Stories-of-Anthony-Trollope-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/64e84e64e94e74e9/Way-We-Live-Now-Trollope-1992-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/44e34e14e94e94e8/The-Complete-Yes-Prime-Minister-by-Jonathan-Lynn.pdf
    • http://unieoooq.linkpc.net/14e04e04e14e54e2/The-Man-from-Halifax-Sir-John-Thompson-Prime-Minister-by-P-B-Waite.pdf
    • http://unieoooq.linkpc.net/24e64e34e84e84e2/The-Prime-Minister-s-Secret-Agent-Maggie-Hope-4-by-Susan-Elia-MacNeal.pdf
    • http://unieoooq.linkpc.net/54e94e44e14e44e2/A-short-history-of-a-ten-years-negociation-between-a-Prime-Minister-and-a-private-gentleman-by-Robert-Whatley.pdf
    • http://unieoooq.linkpc.net/14e14e74e04e94e0/Notes-to-the-Prime-Minister---The-Untold-Story-of-How-Malaysia-Beat-the-Currency-Speculators-by-Sulong-Wong.pdf
    • http://unieoooq.linkpc.net/54e04e14e34e54e0/The-Warden-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/44e94e94e14e44e2/Kept-in-the-Dark-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/74e94e84e74e74e9/Can-You-Forgive-Her-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/44e64e64e84e84e6/The-Way-We-Live-Now-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/54e54e14e64e24e7/The-Lady-of-Launay-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/44e84e74e14e74e7/The-Belton-Estate-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/84e14e94e14e14e6/The-Life-Of-Cicero-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/24e24e34e44e54e0/Barchester-Towers-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/54e04e34e64e44e7/Doctor-Thorne-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/34e74e14e84e74e0/Barchester-Towers-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/14e64e64e94e14e1/Dr-Wortle-s-School-by-Anthony-Trollope.pdf
    • http://unieoooq.linkpc.net/14e04e04e14e54e2/The-Man-from-Halifax-Sir-J

Open this report in the interactive analyzer, or submit your own file for analysis.