Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebe5af58764b7560…

MALICIOUS

PDF

19.2 KB Created: 2019-05-01 17:09:12 +01:00 Authoring application: mPDF 5.7
MD5: fd191d6b53417b81f74887ae3aaea8a0 SHA-1: 7ec9e7fd9511db2d9af90fed36df2d52ea78f4a1 SHA-256: ebe5af58764b756038d1f07d9391393c1e9c9882e601a66fbb4cd1786b59c82b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a malicious intent to redirect users to external content. The ML_NYX_PDF_MALICIOUS heuristic further supports this assessment with a high confidence score. The embedded URLs are likely part of a link farm designed to distribute malware or lead to phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/3f219f215f218f217f219/The-Captive-amp-The-Fugitive-In-Search-of-Lost-Time-5-6-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/7f210f210f212f215f215/In-Search-Of-Lost-Time-Vol-4-The-Fugitive-amp-Time-Regained-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/4f210f218f216f217/Remembrance-of-Things-Past-Volume-III---The-Captive-The-Fugitive-amp-Time-Regained-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/3f215f210f216f217f217/The-Guermantes-Way-In-Search-of-Lost-Time-3-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/4f216f215f210f215f217/Swann-s-Way-In-Search-of-Lost-Time-1-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/3f215f210f214f218f212/Swann-s-Way-In-Search-of-Lost-Time-1-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/4f216f215f215f216f210/Within-A-Budding-Grove-In-Search-of-Lost-Time-2-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/1f213f217f210f216f216/Time-Regained-In-Search-of-Lost-Time-7-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/3f216f210f210f212/In-the-Shadow-of-Young-Girls-in-Flower-In-Search-of-Lost-Time-2-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/5f212f217f217f217f217/La-Prisonni-re-La-Fugitive-2-romans-de-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/7f213f210f215f215f216/Proust-s-Way-A-Field-Guide-to-In-Search-of-Lost-Time-by-Roger-Shattuck.pdf
    • http://kiteeearpdf.myhome.cx/5f215f217f216f215f219/A-la-recherche-du-temps-perdu-Marcel-Proust-500-pages-au-lieu-de-3000-dition-abr-g-e-par-Laurence-Grenier-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/9f213f214f216f214f215/Marcel-Proust-Auf-der-Suche-nach-der-verlorenen-Zeit-Teilausgabe-ca-1100-Seiten-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/6f211f213f214f218f213/Marcel-Proust-Die-Herzogin-von-Guermantes---Auf-der-Suche-nach-der-verlorenen-Zeit-Bd-3-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/5f214f216f212f216f210/The-Complete-Short-Stories-of-Marcel-Proust-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/1f211f218f219f218f218f211/Marcel-Proust-On-Art-and-Literature-1896-1919-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/8f213f217f210f212/Swann-s-Way-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/5f214f216f213f210f217/Pleasures-and-Days-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/8f212f212f210f214f215/Chardin-and-Rembrandt-by-Marcel-Proust.pdf
    • http://kiteeearpdf.myhome.cx/7f216f215f210f210/The-Lemoine-Affair-by-Marcel-Proust.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.