Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecffde25bff6bb17…

MALICIOUS

PDF

23.2 KB Created: 2019-05-14 20:09:40 +01:00 Authoring application: mPDF 5.7
MD5: 298ae56c339a17849c3cc58e9e7de4d5 SHA-1: 48a8b85814e97a991c094e5815ade08983bf0832 SHA-256: ecffde25bff6bb179f2e1791aa20f7b443e0579dba33dd254d315ebe9ab7f638
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While many of these URLs were marked as confirmed benign, the sheer volume and the ML_NYX_PDF_MALICIOUS classification indicate a malicious intent. The document body appears to be heavily obfuscated or corrupted, preventing a clear understanding of its direct purpose beyond linking to external content. The primary attack pattern observed is the creation of a link farm, likely for SEO manipulation or to distribute further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://unieoooq.linkp
    • http://unieoooq.linkpc.net/94e94e34e64e94e9/The-case-of-a-Diamond-Shaped-Birthmark-British-detective-mysteries-by-Helena-Dixon.pdf
    • http://unieoooq.linkpc.net/24e84e64e64e54e0/Over-The-Hills-Closed-Case-British-Murder-Mysteries-Closed-Case-2-by-James-quot-JJ-quot-Jackson.pdf
    • http://unieoooq.linkpc.net/24e84e64e64e54e4/Murder-on-The-Eiffel-Tower-Closed-Case-British-Murder-Mysteries-Closed-Case-3-by-James-quot-JJ-quot-Jackson.pdf
    • http://unieoooq.linkpc.net/14e14e14e94e54e14e1/British-Mystery-Multipacks-Vol-6---British-Spy-Mysteries-The-39-Steps-The-Riddle-of-the-Sands-Bulldog-Drummond-Passenger-from-Calais-The-Czar-s-Spy-2-sequels-to-The-39-Steps-by-John-Buchan.pdf
    • http://unieoooq.linkpc.net/14e24e14e54e74e8/The-Struggle-for-Social-Justice-in-British-Columbia-Helena-Gutteridge-the-Unknown-Reformer-by-Irene-Howard.pdf
    • http://unieoooq.linkpc.net/84e34e04e64e64e9/The-Hardy-Boys-Detective-Handbook-by-Franklin-W-Dixon.pdf
    • http://unieoooq.linkpc.net/94e94e34e44e94e6/Dinosaur-Farm-A-Birthmark-Story-that-is-Not-about-a-Birthmark-by-Kristen-silva.pdf
    • http://unieoooq.linkpc.net/34e64e94e14e3/The-Case-of-the-Displaced-Detective-At-Speed-Displaced-Detective-2-by-Stephanie-Osborn.pdf
    • http://unieoooq.linkpc.net/54e84e94e24e44e1/The-Ivanov-Diamond-Malykant-Mysteries-2-by-Charlotte-E-English.pdf
    • http://unieoooq.linkpc.net/44e74e24e74e54e7/The-Adventures-of-Miles-Diamond-The-Case-of-the-Missing-Twin-by-Derek-Adams.pdf
    • http://unieoooq.linkpc.net/14e04e34e14e84e24e9/Articles-on-Swedish-Children-s-Writers-Including-Astrid-Lindgren-Elsa-Beskow-Helena-Dahlb-Ck-Peter-Pohl-Maria-Gripe-G-Sta-Knutsson-Nils-Egerbrandt-Helena-Nyblom-Helena-Pielichaty-Sven-Nordqvist-Bertil-Almqvist-Hans-Peterson-by-Hephaestus-Books.pdf
    • http://unieoooq.linkpc.net/74e14e94e44e44e5/The-Minuscule-Monk-A-Lizzie-Borden-Girl-Detective-Mystery-Lizzie-Borden-Girl-Detective-Mysteries-Book-1-by-Richard-Behrens.pdf
    • http://unieoooq.linkpc.net/94e04e54e24e14e6/Detective-Gordon-The-First-Case-by-Ulf-Nilsson.pdf
    • http://unieoooq.linkpc.net/14e04e64e34e54e2/Max-Archer-Kid-Detective-The-Case-of-the-Wet-Bed-by-Howard-J-Bennett.pdf
    • http://unieoooq.linkpc.net/44e94e64e14e84e6/Man-with-an-Axe-Detective-Sergeant-Mulheisen-Mysteries-7-by-Jon-A-Jackson.pdf
    • http://unieoooq.linkpc.net/84e04e54e44e04e2/The-Case-of-the-Hermit-s-Guest-Bedroom-Dumfries-Detective-3-by-R-R-Gall.pdf
    • http://unieoooq.linkpc.net/34e54e34e74e74e4/Shadow-s-Return-Psychic-Detective-Mysteries-2-by-S-C-Wynne.pdf
    • http://unieoooq.linkpc.net/34e74e94e74e24e1/Operation-Bunny-The-Fairy-Detective-Agency-s-First-Case-by-Sally-Gardner.pdf
    • http://unieoooq.linkpc.net/24e54e64e34e74e6/The-Case-Of-The-Cupid-Curse-End-Street-Detective-Agency-1-by-Amber-Kell.pdf
    • http://unieoooq.linkpc.net/94e44e84e1/Art-Smart-Science-Detective-The-Case-of-the-Sliding-Spaceship-by-Melinda-Long.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.