Malicious PDF — malware analysis report

Static analysis result for SHA-256 f52ea753a25083f6…

MALICIOUS

PDF

18.9 KB Created: 2019-05-02 17:41:13 +01:00 Authoring application: mPDF 5.7
MD5: 9a609ee180e780f808a3b13a1a1dfa9c SHA-1: 964880ea4f6b4522b1f3784016c89a1d44f739ee SHA-256: f52ea753a25083f697b3dae1905f1e54303b745572588e261f9231ca0bb07ba7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged this file with high confidence. The embedded URLs point to various book titles, suggesting a lure to disguise the malicious intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/1f211f215f219f211f211f212/White-Fang-by-Jack-London-a-Novel-John-Griffith-Jack-London-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/8f211f217f219f211/The-Call-of-the-Wild-and-White-Fang-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/3f215f216f217f216/The-Call-of-the-Wild-White-Fang-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/5f213f211f213f215f218/White-Fang-illustrated---first-published-in-1906-1st-Page-Classics-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/3f212f214f215f217f217/Novels-and-Stories-The-Call-of-the-Wild-White-Fang-The-Sea-Wolf-Klondike-and-Other-Stories-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/8f219f210f216f216f218/Die-bekanntesten-Werke-von-Jack-London-Der-Seewolf-K-nig-Alkohol-Wolfsblut-Martin-Eden-Meuterei-auf-der-Elsinore-Der-Ruhm-des-K-mpfers-An-der-wei-en-Grenze-Lockruf-des-Goldes-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/8f211f217f212f214f218/Call-of-the-Wild-by-Jack-London-Short-Adventure-Novel-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/7f212f217f215f211f212/The-Call-of-the-Wild-A-Jack-London-Trilogy-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/3f216f214f212f210f219/White-Fang-by-Clay-Stafford.pdf
    • http://kiteeearpdf.myhome.cx/2f210f214f219f216f215/Snow-White-and-Rose-Red-The-Curse-of-the-Huntsman-by-Lilly-Fang.pdf
    • http://kiteeearpdf.myhome.cx/2f212f212f212f216f218/The-Unabridged-Jack-London-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/9f213f217f215f210f214/Jack-London-Wolfsblut-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/3f212f213f211f219f215/The-Life-of-London-4-Volume-Set-Elizabeth-s-London-Dr-Johnson-s-London-Restoration-London-and-Victorian-London-by-Liza-Picard.pdf
    • http://kiteeearpdf.myhome.cx/1f212f218f212f213f211/The-Red-One-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/1f212f212f212f217f218/The-Sea-Wolf-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/8f213f211f213f214f215/B-tard-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/1f210f215f215f213f218/Before-Adam-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/3f214f218f211f217/The-Sea-Wolf-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/1f210f212f214f215f215f216/War-of-the-Classes-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/1f213f218f210f219f213/The-Sea-Wolf-by-Jack-London.pdf
    • http://kiteeearpdf.myhome.cx/8f219f210f216f216f218/Die-bekanntesten-Werke-von-Jack-London-Der-Seewolf-K-nig-Alkohol-Wolfsblut-Martin-Eden-Meuterei-auf-der-Elsinore-Der-Ruhm-des-K-mpfers-An-der-wei-en-Grenze-Lockruf-des-Goldes-by-Jack

Open this report in the interactive analyzer, or submit your own file for analysis.