Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5cac34e3af0129e…

MALICIOUS

PDF

15.2 KB Created: 2019-04-30 04:01:57 +01:00 Authoring application: mPDF 5.7
MD5: 5b020c90653c25ea9bb316fc5e73ff2e SHA-1: 6e29d02e4abd43192a412a0ee04f613510764d24 SHA-256: f5cac34e3af0129e4f9cb2b08fd01d305b8815fad77eca4839a0f094a8035440
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. While the ML classifier also flagged this as malicious, the specific intent appears to be the creation of a link farm rather than direct payload delivery. The embedded URLs themselves are not directly malicious but contribute to the overall suspicious nature of the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9778

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a00a04a09a06a05/Snow-White-and-Rose-Red-The-Curse-of-the-Huntsman-by-Lilly-Fang.pdf
    • http://muicuiu.dumb1.com/3a02a00a07a06a08/Rose-Red-amp-Snow-White-A-Grimms-Fairy-Tale-by-Ruth-Sanderson.pdf
    • http://muicuiu.dumb1.com/4a06a07a01a07/Snow-A-Retelling-of-Snow-White-and-the-Seven-Dwarfs-by-Tracy-Lynn.pdf
    • http://muicuiu.dumb1.com/4a04a00a07a08a02/A-Dream-of-Ebony-and-White-A-Retelling-of-Snow-White-Beyond-the-Four-Kingdoms-Book-4-by-Melanie-Cellier.pdf
    • http://muicuiu.dumb1.com/1a03a01a06a07a03/Scent-of-a-White-Rose-The-Rose-Trilogy-1-by-Tish-Thawer.pdf
    • http://muicuiu.dumb1.com/1a00a06a02a04a03/Scent-of-a-White-Rose-The-Rose-Trilogy-1-by-Tish-Thawer.pdf
    • http://muicuiu.dumb1.com/6a01a01a05a09/In-Falling-Snow-by-Mary-Rose-MacColl.pdf
    • http://muicuiu.dumb1.com/1a01a07a00a06a06a06/Acht-Sinne-Kurzgeschichte-Leseprobe-by-Rose-Snow.pdf
    • http://muicuiu.dumb1.com/7a01a00a04a01/Snow-White-and-the-Seven-Dwarfs-by-Wanda-G-g.pdf
    • http://muicuiu.dumb1.com/5a08a09a02a08a08/Snow-White-by-Jacob-Grimm.pdf
    • http://muicuiu.dumb1.com/7a00a06a05a04/Snow-White-by-Jacob-Grimm.pdf
    • http://muicuiu.dumb1.com/4a08a00a01a01a00/Snow-White-by-Charles-Santore.pdf
    • http://muicuiu.dumb1.com/5a00a04a05a02a06/Snow-Angel-by-Chantilly-White.pdf
    • http://muicuiu.dumb1.com/1a02a03a06a08a09/Snow-White-and-the-Seven-Samurai-by-Tom-Holt.pdf
    • http://muicuiu.dumb1.com/6a04a03a02a09/Almost-Snow-White-by-Jeffrey-Blount.pdf
    • http://muicuiu.dumb1.com/3a01a01a07a09a06/Snow-White-by-Trixie-Belle.pdf
    • http://muicuiu.dumb1.com/2a00a03a08a09a01/Snow-White-Gets-Her-Say-by-Chris-Wind.pdf
    • http://muicuiu.dumb1.com/4a07a00a03a00a09/Snow-White-by-Jacob-Grimm.pdf
    • http://muicuiu.dumb1.com/1a06a04a04a03a09/Snow-White-and-the-Seven-Aliens-by-Laurence-Anholt.pdf
    • http://muicuiu.dumb1.com/3a02a03a04a07/Blood-Red-Snow-White-by-Marcus-Sedgwick.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.