Malicious PDF — malware analysis report

Static analysis result for SHA-256 0414292245be904d…

MALICIOUS

PDF

14.5 KB Created: 2019-04-30 02:56:34 +01:00 Authoring application: mPDF 5.7
MD5: c041402e5b7c367a15d1c11a6c77a5dc SHA-1: b0a1b78c4ad2624c7acd198aa572c854009d31a8 SHA-256: 0414292245be904d39d7d326ed77af7a38233a8cac0491e604759a312de39a4b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was flagged by a critical heuristic for containing a large number of external PDF links, suggesting a link farm or redirection scheme. The ML classifier also indicated a high probability of maliciousness. While no scripts were extracted, the embedded URLs point to numerous benign-looking book titles, which is a common tactic to disguise malicious intent or manipulate search engine results. The primary attack pattern observed is the distribution of these links within the document body.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2098090096095091/Visitors-Vanishings-and-Va-Va-Va-Voom-Ally-s-World-12-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/4093095098095094/Awesomely-Ally-s-World-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/2098090096094096/Daisy-Dad-and-the-Huge-Small-Surprise-Ally-s-World-10-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/5090091091094092/Daisy-Dad-and-the-Huge-Small-Surprise-Ally-s-World-10-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/5090090097094095/Boys-Brothers-and-Jelly-Belly-Dancing-Ally-s-World-5-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/2098090096094093/Tattoos-Telltales-and-Terrible-Terrible-Twins-Ally-s-World-8-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/2098090096095093/Rainbows-Rowan-and-True-True-Romance-Ally-s-World-11-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/5090091091094097/Rainbows-Rowan-and-True-True-Romance-Ally-s-World-11-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/2098090096095094/Dates-Double-Dates-and-Big-Big-Trouble-Ally-s-World-2-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/2092091093091099/Six-Words-and-a-Wish-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/4095099090090097/Candy-Girl-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/8093091095092098/Sweet-talking-TJ-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/5099091096097/The-Raspberry-Rules-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/1090099094095097094/Being-Grown-Up-Is-Cool-Not-Indie-Kidd-3-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/1093096095096099/Ally-Wess-Har-Wars-5-by-Karen-Traviss.pdf
    • http://loaminoo.linkpc.net/8097094097095098/The-Vanishings-by-Ann-Letzter.pdf
    • http://loaminoo.linkpc.net/1092096099091098/World-of-Pies-by-Karen-Stolz.pdf
    • http://loaminoo.linkpc.net/1098090090099094/Starbird-Murphy-and-the-World-Outside-by-Karen-Finneyfrock.pdf
    • http://loaminoo.linkpc.net/1098090092096093/The-Visitors-by-Rebecca-Mascull.pdf
    • http://loaminoo.linkpc.net/1096098090099095/All-Visitors-Ashore-by-C-K-Stead.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.