Malicious PDF — malware analysis report

Static analysis result for SHA-256 e95bcbda33b967ca…

MALICIOUS

PDF

16.7 KB Created: 2019-05-06 16:55:48 +01:00 Authoring application: mPDF 5.7
MD5: 96b09a69427266cd494d9c4d1ea99286 SHA-1: 0a07f50564032d04fad6467bcf114b373ad32cb5 SHA-256: e95bcbda33b967ca26f5b1c5e1fa547555092445d31a10cf2395f752dc542e1f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, identified by the PDF_SEO_LINK_FARM heuristic. While the specific intent is unclear due to the lack of executable scripts, this pattern suggests a link farm or a distribution mechanism for further malicious content. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9913

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a02a07a07a08a02/Maybe-the-Moon-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/1a09a04a05a01a01/Babycakes-Tales-of-the-City-4-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/1a00a00a05a00a00/Babycakes-Tales-of-the-City-4-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/8a04a04a01a06a02/Stadtgeschichten-Tales-of-the-City-1-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/1a09a04a04a00a09/Significant-Others-Tales-of-the-City-5-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/1a04a06a04a03a02/Michael-Tolliver-Lives-Tales-of-the-City-7-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/9a07a07a02a07a03/Tales-of-the-City-Episode-2-Confessions-in-the-Nude-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/9a07a07a02a07a02/Goodbye-Barbary-Lane-Tales-of-the-City-Omnibus-7-9-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/9a00a01a02a06a05/Die-Tage-der-Anna-Madrigal-Die-letzten-Stadtgeschichten-Tales-of-the-City-9-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/9a07a07a02a04a01/Back-to-Barbary-Lane-The-Tales-of-the-City-Omnibus-Tales-of-the-City-4-6-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/8a02a06a00a02/The-Complete-Tales-of-the-City-Tales-of-the-City-1-6-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/1a09a04a05a03a03/Further-Tales-of-the-City-Tales-of-the-City-3-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/2a01a07a09a08a09/Further-Tales-of-the-City-Tales-of-the-City-3-by-Armistead-Maupin.pdf
    • http://muicuiu.dumb1.com/1a01a05a08a04a08a00/Robin-Aroon-a-Comedy-of-Manners-by-Armistead-C-Armistead-Churchil-Gordon.pdf
    • http://muicuiu.dumb1.com/1a01a05a08a04a03a00/The-Armistead-Family-1635-1910-by-Virginia-Armistead-Garber.pdf
    • http://muicuiu.dumb1.com/3a06a04a07a07a01/The-Dog-Listener-by-Jan-Fennell.pdf
    • http://muicuiu.dumb1.com/1a01a03a09a01a06a09/The-Listener-by-Taylor-Caldwell.pdf
    • http://muicuiu.dumb1.com/3a07a00a02a08a07/Radio-On-A-Listener-s-Diary-by-Sarah-Vowell.pdf
    • http://muicuiu.dumb1.com/6a04a03a02a04a07/Chopin-A-Listener-s-Guide-to-the-Master-of-the-Piano-by-Victor-Lederer.pdf
    • http://muicuiu.dumb1.com/9a07a07a04a09a01/Computer-Engineer-by-Melissa-Maupin.pdf
    • http://muicuiu.dumb1.com/9a07a07a02a04a01/Back-to-Barbary-Lane-The-Tales-of

Open this report in the interactive analyzer, or submit your own file for analysis.