Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4ebdece01f9a256…

MALICIOUS

PDF

22.7 KB Created: 2019-05-03 05:40:35 +01:00 Authoring application: mPDF 5.7
MD5: dff447d3e65ad60035572c7f25dbba68 SHA-1: be3d005fbb26f10071e197f658918ff57233a5cc SHA-256: f4ebdece01f9a2567454ebf413f38c343cb3340ad52139fed68be4a96bd631b6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by an ML classifier as malicious and contains a large number of embedded URLs. These URLs point to external PDF files, suggesting a link farm or a method to distribute further malicious content. The primary attack pattern appears to be SEO poisoning or a lure to download additional payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/1f210f211f216f218f211f213/A-Tale-of-Two-Cities-the-Classic-European-Novel-by-Charles-Dickens-Classic-Books-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/5f214f213f212f213f210/A-Tale-of-Two-Cities-Volume-21-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/6f214f212f212f216f212/Kids-A-Tale-of-two-Cities-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/8f217f210f218f210f210/A-tale-of-two-cities-By-Charles-Dickens-NOVEL-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/4f212f217f218f211/A-Tale-of-Two-Cities-Great-Expectations-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/8f216f211f214f212f213/A-Tale-of-Two-Cities-A-Reader-s-Companion-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/5f218f219f217f217/A-Tale-of-Two-Cities-and-Oliver-Twist-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/6f212f214f219f215f212/A-Tale-of-Two-Cities-A-Story-of-the-French-Revolution-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/9f214f211f216f213f217/A-Tale-of-Two-Cities-With-18-Illustrations-and-a-Free-Audio-File-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/5f214f218f219f216f211/A-Tale-of-Two-Cities-Illustrated-with-Critical-Thinking-Discussion-Questions-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/8f217f215f217f219f214/Four-Complete-Novels-Great-Expectations-Hard-Times-A-Christmas-Carol-A-Tale-of-Two-Cities-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/7f215f216f210f218f216/Great-Expectations-By-Charles-Dickens---Illustrated-Free-Audiobook-Unabridged-Original-E-Reader-Friendly-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/1f211f219f211f217f214f219/Charles-Dickens-Eine-Weihnachtsgeschichte-A-Christmas-Carol-amp-Vier-weitere-Weihnachtsstories-Illustriert-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/7f211f213f212f213f211/Oliver-Twist-By-Charles-Dickens-Illustrated-amp-Unabridged-Free-Bonus-Audiobook-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/7f211f213f211f217f212/A-Christmas-Carol-By-Charles-Dickens-amp-Illustrated-An-Audiobook-Free-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/2f210f211f219f212f214/Charles-Dickens-The-Complete-Novels-Book-House-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/6f215f211f219f211f216/Oliver-Twist-or-the-Parish-Boy-s-Progress-Charles-Dickens-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/5f216f218f211f218f210/Christmas-with-Charles-Dickens-A-Christmas-Carol-the-Chimes-the-Cricket-on-the-Hearth-the-Battle-of-Life-the-Haunted-Man-and-the-Ghost-s-Bargain-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/4f210f212f212f212f211/Charles-Dickens-Complete-Works-Dombey-and-Son-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/8f212f218f215f215f215/The-Letters-of-Charles-Dickens-Vol-2-1857-1870-by-Charles-Dickens.pdf
    • http://kiteeearpdf.myhome.cx/9f214f211f216f213f217/A-Tale-of-Two-Cities-With-18-Illustrations-and-a-Free-Audio-File-by-Charl

Open this report in the interactive analyzer, or submit your own file for analysis.