Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5c1efb8f486e1ae…

MALICIOUS

PDF

23.9 KB Created: 2019-05-01 18:19:39 +01:00 Authoring application: mPDF 5.7
MD5: 6bf2d1844172eaf35e36bee3e97cdfbd SHA-1: 262a815264d2b8ab85d486d83818c156b833e3b0 SHA-256: f5c1efb8f486e1aefdbff13d95ba833d48bfb72374d75274ad72521000c4498c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a critical heuristic for containing a mass external link farm, with 28 links identified. The document body, though partially corrupted, contains numerous URLs pointing to external PDF files hosted on the `cmeinasaoo.duckdns.org` domain. This suggests the PDF is designed to lure users into clicking these links, potentially leading to further malicious content or downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/1b23b25b21b26b23/Web-of-Lies-The-Hundred-Halls-2-by-Thomas-K-Carpenter.pdf
    • http://cmeinasaoo.duckdns.org/4b27b28b21b25b29/A-Hundred-Little-Lies-by-Jon-Wilson.pdf
    • http://cmeinasaoo.duckdns.org/1b24b25b26b27b29/The-Great-War-One-Hundred-Stories-Of-One-Hundred-Words-Honouring-Those-Who-Lived-and-Died-One-Hundred-Years-Ago-by-Dawn-Knox.pdf
    • http://cmeinasaoo.duckdns.org/7b27b24b28b28b20/Sagan-s-Law-by-Thomas-K-Carpenter.pdf
    • http://cmeinasaoo.duckdns.org/5b20b21b25b24b27/Son-of-a-Hundred-Kings-by-Thomas-B-Costain.pdf
    • http://cmeinasaoo.duckdns.org/4b24b26b20b25b24/Two-Hundred-and-Twenty-One-Baker-Streets-An-Anthology-of-Holmesian-Tales-Across-Time-and-Space-by-David-Thomas-Moore.pdf
    • http://cmeinasaoo.duckdns.org/4b23b26b22b20b21/A-Description-of-Above-Three-Hundred-Animals-Viz-Beasts-Birds-and-Insects-with-a-Particular-Account-of-the-Manner-of-Catching-Whales-in-Gre-by-Thomas-Boreman.pdf
    • http://cmeinasaoo.duckdns.org/2b25b21b26b28b22/Bloody-Lies-by-Thomas-Mollett.pdf
    • http://cmeinasaoo.duckdns.org/1b20b21b20b21b20/American-Conspiracies-Lies-Lies-and-More-Dirty-Lies-that-the-Government-Tells-Us-by-Jesse-Ventura.pdf
    • http://cmeinasaoo.duckdns.org/1b21b28b21b25b25/Blissful-Lies-by-Jennifer-Brown-Thomas.pdf
    • http://cmeinasaoo.duckdns.org/5b23b26b20b22b21/Love-Lies-Karma-2-by-Kiera-Thomas.pdf
    • http://cmeinasaoo.duckdns.org/5b23b26b20b21b22/Love-Lies-Karma-by-Kiera-Thomas.pdf
    • http://cmeinasaoo.duckdns.org/8b24b21b26b26b27/Genealogy-of-the-de-Veaux-Family-Introducing-the-Numerous-Forms-of-Spelling-the-Name-by-Various-Branches-and-Generations-in-the-Past-Eleven-Hundred-Years-by-Thomas-F-1811-1892-De-Voe.pdf
    • http://cmeinasaoo.duckdns.org/8b24b21b26b26b28/Genealogy-of-the-de-Veaux-Family-Introducing-the-Numerous-Forms-of-Spelling-the-Name-by-Various-Branches-and-Generations-in-the-Past-Eleven-Hundred-Years-by-Thomas-F-1811-1892-De-Voe.pdf
    • http://cmeinasaoo.duckdns.org/1b21b26b23b22b28b20/Publick-Education-Particularly-in-the-Charity-Schools-a-Sermon-Preach-d-at-St-Philip-s-Church-in-Birmingham-August-9-1724-at-the-Opening-of-a-Charity-School-Built-to-Receive-an-Hundred-Children-by-Thomas-Bisse.pdf
    • http://cmeinasaoo.duckdns.org/3b25b22b23b24b22/The-Familiars-by-Stacey-Halls.pdf
    • http://cmeinasaoo.duckdns.org/3b20b28b28b21b22/Netherby-Halls-by-Claudette-Williams.pdf
    • http://cmeinasaoo.duckdns.org/4b28b29b23b28b29/Shafting-the-Halls-Shaft-on-Tour-4-by-Cat-Mason.pdf
    • http://cmeinasaoo.duckdns.org/1b20b26b27b22b21b21/Hundred-Year-War-Chronicles-of-the-Hundred-Year-War-by-Klaus-Schwanitz.pdf
    • http://cmeinasaoo.duckdns.org/1b22b24b28b25b29/Wild-Dogs-Past-amp-Present-by-Kelly-Milner-Halls.pdf
    • http://cmeinasaoo.duckdns.org/4b23b26b22b20b21/A-Description-of-Above-Three-Hundred-Animals-Viz-Beasts-Birds-and-Insects-with-a-Particular-Account-of-the-Manner-of-Catching-Whales-in-G

Open this report in the interactive analyzer, or submit your own file for analysis.