Malicious PDF — malware analysis report

Static analysis result for SHA-256 064db7eaa2a0b6a7…

MALICIOUS

PDF

17.6 KB Created: 2019-04-30 03:46:57 +01:00 Authoring application: mPDF 5.7
MD5: afb622d213a8e8d16488896d90d0fe57 SHA-1: e8b5f9f916b0b11911d3e778e25c174d365998e6 SHA-256: 064db7eaa2a0b6a73c3c0d49e6b7c940953fe4daf313d3f7318072e1096683e4
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO poisoning or to create link farms. While the document body itself is heavily obfuscated, the heuristic 'PDF_SEO_LINK_FARM' strongly indicates this malicious intent. The ML classifier also flagged the PDF as malicious. No scripts were extracted, but the embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5090099093091098/The-Lion-Wakes-A-Modern-History-of-HSBC-by-Richard-Roberts.pdf
    • http://loaminoo.linkpc.net/1094092091097092/A-True-Likeness-The-Black-South-of-Richard-Samuel-Roberts-1920-1936-by-Richard-Samuel-Roberts.pdf
    • http://loaminoo.linkpc.net/3099092092097095/Theravada-Buddhism-A-Social-History-from-Ancient-Benares-to-Modern-Colombo-by-Richard-F-Gombrich.pdf
    • http://loaminoo.linkpc.net/1095090094098090/A-Second-Daniel-In-the-Den-of-the-English-Lion-1-by-Neal-Roberts.pdf
    • http://loaminoo.linkpc.net/1092097091093090/Operation-Sea-Lion-by-Richard-Hubert-Francis-Cox.pdf
    • http://loaminoo.linkpc.net/5095096095094095/The-Off-Modern-Psychology-Estranged-by-Ron-Roberts.pdf
    • http://loaminoo.linkpc.net/2090093092092091/Quite-Contrary-by-Richard-Roberts.pdf
    • http://loaminoo.linkpc.net/7095094099097/Please-Don-t-Tell-My-Parents-You-Believe-Her-by-Richard-Roberts.pdf
    • http://loaminoo.linkpc.net/8099090097091096/Schroders-Merchants-amp-Bankers-by-Richard-Roberts.pdf
    • http://loaminoo.linkpc.net/4090092094090096/The-Penguin-History-of-the-World-by-J-M-Roberts.pdf
    • http://loaminoo.linkpc.net/5091094097099090/The-Unnatural-History-of-the-Sea-by-Callum-Roberts.pdf
    • http://loaminoo.linkpc.net/2097097098097090/The-Penguin-History-of-the-World-by-J-M-Roberts.pdf
    • http://loaminoo.linkpc.net/8098090092097097/A-History-of-New-York-in-101-Objects-by-Sam-Roberts.pdf
    • http://loaminoo.linkpc.net/5090099093092090/Saving-the-City-The-Great-Financial-Crisis-of-1914-by-Richard-Roberts.pdf
    • http://loaminoo.linkpc.net/6097096098094090/Red-Lion-Blue-Lion-WARS-The-Battle-of-Phobos---Gongen-Part-2-of-3-by-Sabrina-Fried.pdf
    • http://loaminoo.linkpc.net/2095093095095098/A-Lion-Called-Christian-The-True-Story-of-the-Remarkable-Bond-Between-Two-Friends-and-a-Lion-by-Anthony-Bourke.pdf
    • http://loaminoo.linkpc.net/5091092095093093/3-1-3-gatsu-no-Lion-1-March-comes-in-like-a-lion-1-by-Chica-Umino.pdf
    • http://loaminoo.linkpc.net/4095098099092096/Modern-Poems-An-Introduction-to-Poetry-by-Richard-Ellmann.pdf
    • http://loaminoo.linkpc.net/4098098099095/A-History-of-the-English-Speaking-Peoples-Since-1900-by-Andrew-Roberts.pdf
    • http://loaminoo.linkpc.net/3092098091098094/Alone-on-the-Ice-The-Greatest-Survival-Story-in-the-History-of-Exploration-by-David-Roberts.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.