Malicious PDF — malware analysis report

Static analysis result for SHA-256 040202bf1b60c8c0…

MALICIOUS

PDF

13.4 KB Created: 2019-05-03 02:31:34 +01:00 Authoring application: mPDF 5.7
MD5: 8bf274968d0d501ba20ac0247fc24f58 SHA-1: 476b64320ade24f53f3ef61bc24f9526de663178 SHA-256: 040202bf1b60c8c0092f2f5d949ca25d68bb908184d5f362253a893a80025e58
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, identified as a link farm. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves directing users to a multitude of external PDF files, likely to manipulate search engine results or host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7094098094093094/Big-Book-of-The-Hamptons-The-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098091094094/The-Big-Book-of-the-Hamptons-by-Assouline.pdf
    • http://loaminoo.linkpc.net/3093096096097091/It-Happens-in-the-Hamptons-by-Holly-Peterson.pdf
    • http://loaminoo.linkpc.net/4097091092095092/Summer-Sins-Hot-in-the-Hamptons-3-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/8091099099096/Trolls-in-the-Hamptons-Willow-Tate-1-by-Celia-Jerome.pdf
    • http://loaminoo.linkpc.net/9095094094096098/Savoring-the-Hamptons-Discovering-the-Food-and-Wine-of-Long-Island-s-East-End-by-Silvia-Lehrer.pdf
    • http://loaminoo.linkpc.net/7094098094093092/Art-amp-Design-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098092097095/Les-Must-de-Cartier-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098094092094/Leather-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098094090094/Fashion-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098092097090/Cadillac-110-Years-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098091094090/Inspired-Styles-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098094094092/Nigel-Goes-to-France-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098092097099/Cabinet-de-Curiosites-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098094093093/Paper-Library-Candle-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098095092098/Dior-Jewelry-by-Assouline-Publishing.pdf
    • http://loaminoo.linkpc.net/7094098093099095/Bon-Voyage-Travel-Suitcase-by-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098095093091/Dior-Perfume-by-Assouline-Publishing.pdf
    • http://loaminoo.linkpc.net/5095098097090097/Simenon-A-Biography-by-Pierre-Assouline.pdf
    • http://loaminoo.linkpc.net/7094098091094096/Parsons-Designers-The-School-of-Fashion-by-Assouline.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.