Malicious PDF — malware analysis report

Static analysis result for SHA-256 edd377135c7dfd1f…

MALICIOUS

PDF

21.1 KB Created: 2019-05-07 08:21:53 +01:00 Authoring application: mPDF 5.7
MD5: 8b9a155584533d3190fcb0012b09d50d SHA-1: e955082237b399b91d43623e44e8144ec6932efb SHA-256: edd377135c7dfd1fffd022c18dac406cc378c73a4d6eb138261394dcdb1be69f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier strongly indicated maliciousness. No scripts were extracted from this sample, but the heuristic firing suggests a link farm attack pattern. The IOCs are the URLs extracted from the document body.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a01a07a07a00a09a08/York-Notes-on-quot-Northanger-Abbey-quot-by-Jane-Austen-York-Notes-by-A-Norman-Jeffares.pdf
    • http://muicuiu.dumb1.com/1a01a01a09a02a08a05/York-Notes-on-The-Thirty-Nine-Steps-by-John-Buchan-by-A-Norman-Jeffares.pdf
    • http://muicuiu.dumb1.com/7a05a05a05a08a05/Northanger-Abbey-quot-There-is-nothing-I-would-not-do-for-those-who-are-really-my-friends-I-have-no-notion-of-loving-people-by-halves-it-is-not-my-nature-quot-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/1a01a07a07a01a00a03/Four-Major-Works-by-Jane-Austen-Northanger-Abbey-Lady-Susan-Sense-and-Sensibility-Pride-and-Prejudice-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/7a04a00a06a01a05/L-Abbaye-de-Northanger---suivi-de-Catherine-Morland-2-traductions-fran-aises-de-Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/6a04a07a00a04a03/Much-Ado-About-Nothing-York-Notes-for-KS3-Shakespeare-York-Notes-Key-Stage-3-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/1a01a07a06a09a02a08/Jane-Austen-Pride-and-Prejudice---Northanger-Abbey---Persuasion-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/5a05a08a04a06a05/The-Novels-of-Jane-Austen-Northanger-Abbey-In-Ten-Volumes-Vol-IX-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/1a01a07a06a09a03a01/The-Complete-Works-of-Jane-Austen-In-One-Volume-Sense-and-Sensibility-Pride-and-Prejudice-Mansfield-Park-Emma-Northanger-Abbey-Persuasion-Lady-Sandition-and-the-Complete-Juvenilia-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/6a04a02a07a06a00/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/3a07a01a02a09a01/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/4a06a08a04a05a06/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/1a07a01a09a07a05/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/4a06a01a04a03a02/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/3a02a04a07a05/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/9a05a09a01a04a05/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/7a02a03a00a09a06/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/8a09a06a02a00/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/5a06a09a03a05a04/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/3a02a04a05a05a03/Northanger-Abbey-by-Jane-Austen.pdf
    • http://muicuiu.dumb1.com/7a04a00a06a0

Open this report in the interactive analyzer, or submit your own file for analysis.