Malicious PDF — malware analysis report

Static analysis result for SHA-256 eba8fd8e7e6e06f9…

MALICIOUS

PDF

14.8 KB Created: 2019-05-01 19:26:07 +01:00 Authoring application: mPDF 5.7
MD5: ab935f25402569572a45832fb637acf8 SHA-1: 484e87abe4b79437cb810c9d04244265c1dae4b8 SHA-256: eba8fd8e7e6e06f9b40fd055728992dc10b460c35fccdcb9b833f550c5c857c9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves directing users to a dynamic DNS domain hosting numerous files, likely as a lure or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns
    • http://cmeinasaoo.duckdns.org/6b29b21b23b22b20/Debbie-Macomber-Cedar-Cove-CD-Collection-3-8-Sandpiper-Way-92-Pacific-Boulevard-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/2b20b27b24b20/There-s-Something-about-Christmas-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/4b28b21b23b27b23/The-Christmas-Basket-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/2b20b20b20b27b20/Christmas-Wishes-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/1b20b22b27b25b24/Debbie-Macomber-s-Cedar-Cove-Series-First-Six-Books-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/1b28b27b20b25b26/Christmas-in-Cedar-Cove-An-Anthology-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/1b20b22b28b29b23/1225-Christmas-Tree-Lane-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/5b20b21b29b26b28/A-Country-Christmas-Return-to-Promise-Buffalo-Valley-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/3b27b23b29b27b25/1225-Christmas-Tree-Lane-Cedar-Cove-12-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/1b20b23b20b20b26/A-Cedar-Cove-Christmas-Cedar-Cove-8-5-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/1b25b28b28b22b20/Thursdays-At-Eight-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/2b22b29b20b24b22/Father-s-Day-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/3b27b24b23b20b20/That-Wintry-Feeling-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/1b20b25b25b21b28b20/Debbie-Macomber-A-Biography-by-Aileen-Wen.pdf
    • http://cmeinasaoo.duckdns.org/3b20b24b27b26b26/Wyoming-Brides-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/3b28b20b28b26b27/Same-Time-Next-Year-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/1b22b22b22b22/The-Snow-Bride-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/4b20b27b25b20b27/The-Bachelor-Prince-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/3b24b28b27b24b24/74-Seaside-Avenue-by-Debbie-Macomber.pdf
    • http://cmeinasaoo.duckdns.org/4b23b21/Last-One-Home-New-Beginnings-1-by-Debbie-Macomber.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.