Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed817b72806a1b95…

MALICIOUS

PDF

16.7 KB Created: 2019-04-30 01:56:25 +01:00 Authoring application: mPDF 5.7
MD5: b52fbbeb3b07c3b7a080cc08387cf6cc SHA-1: cf461509048b07a49d88bcc9ffd2220702cb7073 SHA-256: ed817b72806a1b9590f6a9035ab69425598897db2ea8ef09c8f996f6184e3f1b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. While most of these links were classified as benign, the sheer volume and the heuristic firing suggest a malicious intent, possibly for SEO poisoning or to distribute further malicious content. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9913

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a07a07/The-Shadow-Cabinet-Shades-of-London-3-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/9a08a03a04a02a09/Die-Schatten-von-London-Shades-of-London-1-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/4a02a09a00a06a01/The-Name-of-the-Star-Shades-of-London-1-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/2a01a04a04a02a00/Untitled-Shades-of-London-4-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/1a02a03a04a03a04/The-Madness-Underneath-Shades-of-London-2-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/1a04a03a02a01a01/Girl-at-Sea-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/5a08a02a09a03/The-Last-Little-Blue-Envelope-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/2a01a04a04a02a01/The-Vanishing-Stair-Truly-Devious-2-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/4a02a06a09a06a04/The-Vanishing-Stair-Truly-Devious-2-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/1a00a07a09a00a09a07/Fifty-Shades-Trilogy-Fifty-Shades-of-Grey-Fifty-Shades-Darker-Fifty-Shades-Freed-3-volume-a-review-by-Nick-Walton.pdf
    • http://muicuiu.dumb1.com/3a02a03a09a06a02/Johnson-s-Life-Of-London-The-People-Who-Made-The-City-That-Made-The-World-by-Boris-Johnson.pdf
    • http://muicuiu.dumb1.com/8a01a03a01/How-I-Resist-Activism-and-Hope-for-the-Next-Generation-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/1a02a05a02a01a03/Cleopatra-Ascending-Shadow-s-Edge-2-by-Maureen-Lipinski.pdf
    • http://muicuiu.dumb1.com/2a05a07a05a03a07/Dr-Johnson-s-London-by-Liza-Picard.pdf
    • http://muicuiu.dumb1.com/4a06a02a09a09a07/13-Little-Blue-Envelopes-Little-Blue-Envelope-1-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/6a09a05a06a03/13-Little-Blue-Envelopes-Little-Blue-Envelope-1-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/1a01a03a07a05a00/Shadow-Team-GB-Starbirth-3-by-J-M-Johnson.pdf
    • http://muicuiu.dumb1.com/3a07a01a02a02/Shadow-Team-GB-Starbirth-3-by-J-M-Johnson.pdf
    • http://muicuiu.dumb1.com/6a04a07a07a08a01/In-the-Shadow-of-London-The-Tube-Riders-4-by-Chris-Ward.pdf
    • http://muicuiu.dumb1.com/1a01a08a08a08a09a03/Suite-Scarlett-Scarlett-1-by-Maureen-Johnson.pdf
    • http://muicuiu.dumb1.com/2a01a04a04a02a01/Th

Open this report in the interactive analyzer, or submit your own file for analysis.