Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd8d33767934d598…

MALICIOUS

PDF

19.1 KB Created: 2019-05-01 05:14:21 +01:00 Authoring application: mPDF 5.7
MD5: e4ae342b7a5830402a8ec0fa2246e4eb SHA-1: 7034eb51d0cb55316701b5f690e7eecfc49d5060 SHA-256: fd8d33767934d59837f1e9c5d38ea6defd55058e502ee2c20d23f04c82a8faef
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs all point to book download pages hosted on the same domain, suggesting a link farm or SEO poisoning tactic. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/4203204207206208/The-Vampire-King-The-Horn-King-Series-Book-3-by-Brae-Wyckoff.pdf
    • http://xiixmcuin.linkpc.net/7205203206206/KING-SERIES-BUNDLE-The-Four-Book-Set-King-1-4-by-T-M-Frazier.pdf
    • http://xiixmcuin.linkpc.net/2209205203206207/The-Dragon-King-Book-one-of-the-Chronicles-of-a-King-by-Daniel-Williams.pdf
    • http://xiixmcuin.linkpc.net/1200202202209203202/Concubine-of-the-King-The-King-s-Pleasure-Book-2-by-Loreley-Delorey.pdf
    • http://xiixmcuin.linkpc.net/5205205203203206/Legend-of-the-New-Age-NEW-SERIES-LIKE-HUNGER-GAMES-Book-One-Exile-RAW-EDITION-Legend-of-New-Age-NEW-SERIES-1-by-Abram-King.pdf
    • http://xiixmcuin.linkpc.net/7203201207/The-King-of-Bones-and-Ashes-Witches-of-New-Orleans-1-by-J-D-Horn.pdf
    • http://xiixmcuin.linkpc.net/6202208201208203/The-King-of-Trees-Three-Novellas-The-King-of-Trees-The-King-of-Chess-The-King-of-Children-by-Ah-Cheng.pdf
    • http://xiixmcuin.linkpc.net/6203204207207204/King-Arthur-Sir-Mordred-and-Sir-Marrock-King-Arthur-series-by-Barbara-Sullivan.pdf
    • http://xiixmcuin.linkpc.net/1207203203202204/Seduced-by-the-Vampire-King-Vampire-Warrior-Kings-2-by-Laura-Kaye.pdf
    • http://xiixmcuin.linkpc.net/1201205204203202206/Apuka-and-the-Legend-of-the-Reaper-King-Book-One-Rise-of-the-Reaper-King-by-Jesse-Arzt.pdf
    • http://xiixmcuin.linkpc.net/5202209209200/Horn-Horn-The-Horn-Horn-Series-1-by-A-D-T-McLellan.pdf
    • http://xiixmcuin.linkpc.net/1200206206207206/Horn-Horn-The-Horn-Horn-Series-by-A-D-T-McLellan.pdf
    • http://xiixmcuin.linkpc.net/9204208207208201/Sins-of-a-King-SINS-Series-Book-1-by-Emma-Slate.pdf
    • http://xiixmcuin.linkpc.net/3201200200200203/Vampire-Bites-Vampire-Paranormal-Romance-Boxed-Set-Vampire-Bites-Anthology-Series-Book-1-by-Gina-Kincade.pdf
    • http://xiixmcuin.linkpc.net/2208202205201205/Vampire-Lust-King-s-Blood-3-by-P-J-Day.pdf
    • http://xiixmcuin.linkpc.net/2202200201203201/The-King-s-Vampire-by-Brenda-Stinnett.pdf
    • http://xiixmcuin.linkpc.net/8203206203200204/Masks-Book-Two-An-Erotic-Vampire-Romance-The-Vampire-Mask-Series-2-by-Sookie-Shepherd.pdf
    • http://xiixmcuin.linkpc.net/8203206202208208/Masks-Book-Four-An-Erotic-Vampire-Romance-The-Vampire-Mask-Series-4-by-Sookie-Shepherd.pdf
    • http://xiixmcuin.linkpc.net/3201207204207205/Escape-Vampire-King-1-by-Kenya-Wright.pdf
    • http://xiixmcuin.linkpc.net/5200207201209/The-Vampire-King-The-Kings-1-by-Heather-Killough-Walden.pdf
    • http://xiixmcuin.linkpc.net/6202208201208203/The-King-of-Trees-Three-Novellas-The-

Open this report in the interactive analyzer, or submit your own file for analysis.