Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea223d3a98728420…

MALICIOUS

PDF

20.7 KB Created: 2019-05-02 01:05:19 +01:00 Authoring application: mPDF 5.7
MD5: 1845ee46dc889d98879e386b480cd049 SHA-1: c1a80d58408efb4559ce5e79073bb586885bb464 SHA-256: ea223d3a98728420b520f4344ed2018d0202be775c0c071e926b619f17a961be
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, disguised as book titles, which is indicative of a link farm or phishing lure. The ML classifier strongly flagged this PDF as malicious. While the document body was unreadable, the heuristic 'PDF_SEO_LINK_FARM' indicates the primary malicious function is to direct users to external URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/9a03a03a09a00a07/Norman-Vincent-Peale-The-Inspirational-Writings-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a04a00a06a09/The-Art-of-Living-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/6a07a03a00a02a06/A-Guide-to-Confident-Living-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a03a09a01a00/Power-of-Positive-Living-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a03a09a07a00/The-Positive-Principle-Today-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/7a08a04a04a07a00/Enthusiasm-Makes-the-Difference-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a04a01a01a08/The-Positive-Way-To-Change-Your-Life-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a04a01a01a02/Life-Beyond-Death-Why-I-Believe-in-Heaven-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a04a00a00a01/Discovering-the-Power-of-Positive-Thinking-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a03a09a05a03/Why-Some-Positive-Thinkers-Get-Powerful-Results-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/5a02a03a06a04a09/Positive-Imaging-The-Powerful-Way-to-Change-Your-Life-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a04a00a01a05/In-God-We-Trust-A-Positive-Faith-for-Troubled-Times-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/7a01a00a06a09a04/El-Poder-Del-Pensamiento-Tenaz-The-Power-of-Positive-Thinking-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/6a02a04a01a06a06/The-Power-of-Positive-Thinking-10-Traits-for-Maximum-Results-by-Norman-Vincent-Peale.pdf
    • http://muicuiu.dumb1.com/9a03a03a09a06a05/The-American-Myth-of-Success-From-Horatio-Alger-to-Norman-Vincent-Peale-by-Richard-Weiss.pdf
    • http://muicuiu.dumb1.com/6a07a07a07a03a00/Hearts-Touched-with-Fire-My-500-Favorite-Inspirational-Quotations-by-Elizabeth-Dole.pdf
    • http://muicuiu.dumb1.com/9a03a03a09a05a05/The-Power-of-Ethical-Management-by-Norman-V-Peale.pdf
    • http://muicuiu.dumb1.com/3a02a03a01a02a02/Favorite-Quotations-from-the-Collection-of-Thomas-S-Monson-by-Thomas-S-Monson.pdf
    • http://muicuiu.dumb1.com/9a03a04a01a01a00/The-Selected-Papers-of-Charles-Willson-Peale-and-His-Family-Volume-5-The-Autobiography-of-Charles-Willson-Peale-by-Charles-Willson-Peale.pdf
    • http://muicuiu.dumb1.com/1a01a03a06a06a02/Courageous-Gilbert-the-Groundhog-2016-Mom-s-Choice-Awards-Gold-Medal-Pinnacle-Medal-Readers-Favorite-5-Star-Review-and-Readers-Favorite-International-Gold-Medal-Winner-by-Regina-E-McCarthy.pdf
    • http://muicuiu.dumb1.com/9a03a04a0

Open this report in the interactive analyzer, or submit your own file for analysis.