Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe21fe154c561be8…

MALICIOUS

PDF

26.9 KB Created: 2020-03-20 17:04:42 +00:00 Authoring application: mPDF 5.7
MD5: 7fe1cfd81c4c586e0602c85c078b1666 SHA-1: 57ac1f57a40c8731c4983839def576fd0c3b68e1 SHA-256: fe21fe154c561be88c3998ee0001145a68696ed2e8202bda55b00588f28d4a75
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDFs hosted on the domain 'eascasas.myhome.cx'. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9912

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eascasas.myhome.cx/9aa3aa9aa7aa7aa8/Sieben-Jahre-In-Tibet-Mit-Heinrich-Harrers-Rede-Vor-Der-Royal-Geographical-Society-2002-by-Heinrich-Harrer.pdf
    • http://eascasas.myhome.cx/8aa6aa7aa9aa8aa1/Sieben-Jahre-in-Tibet-Mein-Leben-am-Hofe-des-Dalai-Lama-by-Heinrich-Harrer.pdf
    • http://eascasas.myhome.cx/1aa0aa6aa6aa7aa1aa6/Seven-Years-in-Tibet-by-Heinrich-Harrer.pdf
    • http://eascasas.myhome.cx/1aa0aa3aa6aa4aa9aa6/The-Great-Escape-Tibet-and-Lhasa-by-Heinrich-Harrer.pdf
    • http://eascasas.myhome.cx/1aa1aa4aa9aa1aa9aa2/Der-Hexenhammer-Ein-Werk-zur-Legitimation-der-Hexenverfolgung-das-der-Dominikaner-Heinrich-Kramer-lat-Henricus-Institoris-im-Jahre-1486-ver-ffentlichte-by-Heinrich-Institoris.pdf
    • http://eascasas.myhome.cx/9aa6aa5aa0aa1aa8/Herzog-Aquitanien-Richard-Lowenherz-Heinrich-IV-Heinrich-V-John-of-Gaunt-1-Duke-of-Lancaster-Heinrich-VI-Eduard-III-Ludwig-VII-by-Quelle-Wikipedia.pdf
    • http://eascasas.myhome.cx/1aa0aa3aa2aa5aa0aa5/Denk-Ich-An-Bhutan-by-Heinrich-Harrer.pdf
    • http://eascasas.myhome.cx/1aa1aa4aa5aa4aa9aa3/Heinrich-Schreyber-Aus-Erfurt-Genannt-Grammateus-Festschrift-Zum-500-Geburtstag-by-Heinrich-Schreiber.pdf
    • http://eascasas.myhome.cx/1aa0aa7aa7aa7aa9aa5/Vorbericht-Und-Inhaltsverzeichnis-Zu-Heinrich-Laubes-Gesammelten-Werken-In-F-nfzig-B-nden-by-Heinrich-Laube.pdf
    • http://eascasas.myhome.cx/9aa6aa3aa7aa4aa2/15-Jahre-bei-den-Kannibalen-in-Zentral-Afrika-by-Heinrich-Suso-Waldeck.pdf
    • http://eascasas.myhome.cx/8aa6aa9aa7aa0aa8/K-nig-Heinrich-der-vierte-Der-Zweyte-Theil-der-seinen-Tod-und-die-Cr-nung-von-Heinrich-dem-f-nften-enth-lt-by-William-Shakespeare.pdf
    • http://eascasas.myhome.cx/7aa8aa3aa5aa5aa8/200-Jahre-Charite-Stadtische-Kliniken-Kassel-Beitrage-Zur-Entwicklungsgeschichte-Des-Krankenhauswesens-Von-1785-Bis-1985-by-Joachim-Heinrich-Balde.pdf
    • http://eascasas.myhome.cx/1aa1aa2aa5aa4aa9aa6/Der-Geitzige-Ein-Lustspiel-in-F-nf-Aufz-gen-Nach-Moliere-F-r-Die-Deutsche-B-hne-Von-Heinrich-Zschokke-by-Heinrich-Zschokke.pdf
    • http://eascasas.myhome.cx/1aa1aa6aa2aa7aa7aa5/Dr-Heinrich-M-llers-Weil-Seniors-Und-Superintendenten-Zu-Rostock-Kreuz--Buss--Und-Betschule-Wahrer-Christen-In-Zwei-Und-Zwanzig-Beitrachtungen-Der-Gemeine-Gottes-Zu-St-Marien-in-Den-ffentlichen-Betstunden-Vorgestellt-by-Heinrich-Muller.pdf
    • http://eascasas.myhome.cx/2aa6aa3aa9aa8aa7/The-Complete-Poems-of-Heinrich-Heine-A-Modern-English-Version-by-Heinrich-Heine.pdf
    • http://eascasas.myhome.cx/4aa9aa4aa7aa6aa6/A-Naturalist-at-Large-The-Best-Essays-of-Bernd-Heinrich-by-Bernd-Heinrich.pdf
    • http://eascasas.myhome.cx/1aa1aa2aa5aa6aa3aa2/Heinrich-Zschokke-s-Novellen-Und-Dichtungen-Vol-9-of-15-by-Heinrich-Zschokke.pdf
    • http://eascasas.myhome.cx/1aa1aa2aa5aa6aa7aa6/Heinrich-Zschokke-s-Novellen-Und-Dichtungen-Vol-9-of-15-by-Heinrich-Zschokke.pdf
    • http://eascasas.myhome.cx/9aa3aa3aa9aa3aa3/The-Prose-Writings-of-Heinrich-Heine-by-Heinrich-Heine.pdf
    • http://eascasas.myhome.cx/1aa0aa6aa6aa9aa9aa9/Sieben-Leben-Hat-Die-Woche-Gedichte-1981-2002-by-Mario-Wirz.pdf
    • http://eascasas.myhome.cx/9aa6aa5aa0aa1aa8/Herzog-Aquitanien-Richard-Low

Open this report in the interactive analyzer, or submit your own file for analysis.