Malicious PDF — malware analysis report

Static analysis result for SHA-256 f05bb961267d0ace…

MALICIOUS

PDF

15.9 KB Created: 2019-04-30 01:57:46 +01:00 Authoring application: mPDF 5.7
MD5: 30826aa9a2ea8e331ba28050a25fa932 SHA-1: 8999b60e514d947bde41eb997e7dd6c2ba277a46 SHA-256: f05bb961267d0ace17ab432c2d10e176d92b9a888219823e3eeefd28ec798c25
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The embedded URLs, while individually marked as benign, collectively suggest a malicious intent to redirect users, likely for SEO poisoning or to distribute further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a07a05a07a08a09/Writer-to-Writer-From-Think-to-Ink-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/3a05a01a03a06a01/Fairest-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/5a07a00a09/Ella-Enchanted-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/3a02a00a04a09a08/The-Two-Princesses-of-Bamarre-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/4a05a06a06a07a04/Ella-Enchanted-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/4a07a09a05a01a04/Fairy-Dust-and-the-Quest-for-the-Egg-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/7a09a01a02a03a04/Writer-Ask-Not-Was-it-merely-Writer-s-Block-or-something-more-sinister-by-Anton-Julliard.pdf
    • http://muicuiu.dumb1.com/1a06a09a09a00a00/Fairies-and-the-Quest-for-Never-Land-Disney-Fairies-3-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/9a00a01a02a06/The-Princess-Test-The-Princess-Tales-2-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/3a03a07a08a08/The-Two-Princesses-of-Bamarre-The-Two-Princesses-of-Bamarre-1-by-Gail-Carson-Levine.pdf
    • http://muicuiu.dumb1.com/1a07a08a04a06a08/The-Obituary-Writer-by-Ann-Hood.pdf
    • http://muicuiu.dumb1.com/2a01a05a03a03a07/The-Obituary-Writer-by-Ann-Hood.pdf
    • http://muicuiu.dumb1.com/4a04a00a01a05a04/Monsoon-by-Night-Writer.pdf
    • http://muicuiu.dumb1.com/3a02a04a08a08a05/Host-Writer-The-Archivist-1-by-W-F-Kuehn.pdf
    • http://muicuiu.dumb1.com/5a04a02a05a08a02/The-Book-The-Writer-by-Zoran-ivkovi-.pdf
    • http://muicuiu.dumb1.com/7a07a02a00a05a01/Grave-Writer-by-Mark-Arsenault.pdf
    • http://muicuiu.dumb1.com/1a06a04a09a04a00/The-Afternoon-of-a-Writer-by-Peter-Handke.pdf
    • http://muicuiu.dumb1.com/3a04a06a04a00a04/The-Story-s-Writer-by-Wayne-Lemmons.pdf
    • http://muicuiu.dumb1.com/7a06a02a07a03a07/Michener-A-Writer-s-Journey-by-Stephen-J-May.pdf
    • http://muicuiu.dumb1.com/1a06a01a06a05a09/Are-You-There-Blog-It-s-Me-Writer-by-Kristen-Lamb.pdf
    • http://muicuiu.dumb1.com/3a03a07a08a08/The-Two-Princesses-of-Bamar

Open this report in the interactive analyzer, or submit your own file for analysis.