Malicious PDF — malware analysis report

Static analysis result for SHA-256 06e2bec0d4b4dbca…

MALICIOUS

PDF

15.2 KB Created: 2019-04-30 05:18:28 +01:00 Authoring application: mPDF 5.7
MD5: 0e7115a311db2f3ca27c1873b27f2c17 SHA-1: 913304e062d3d86c421fd9f0a919fd510b4a059a SHA-256: 06e2bec0d4b4dbca715e10a7f3b20ae46d1ca8f27d3551302cf316d1ebfd476a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently classified as benign, the sheer volume and the heuristic firing of 'PDF_SEO_LINK_FARM' suggest a malicious intent, possibly for SEO manipulation or to distribute further malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5098094093097090/King-of-Embers-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/1092096094095098/King-of-Foxes-Conclave-of-Shadows-2-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/5098094093096093/Rage-of-a-Demon-King-Shadow-of-a-Dark-Queen-Rise-of-a-Merchant-Prince-The-Serpentwar-Saga-1-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3099098094093/Faerie-Tale-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3094094090091093/Faerie-Tale-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/2097091099094094/Magician-The-Riftwar-Saga-1-2-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/1095096094093092/Magician-Apprentice-Volume-2-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/4091095090091095/Wrath-of-a-Mad-God-The-Darkwar-Saga-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3096096090091093/Magician-s-End-The-Chaoswar-Saga-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/6094096099090/Magician-s-End-The-Chaoswar-Saga-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/4097091090094091/Magician-Apprentice-The-Riftwar-Saga-1-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3095090097099098/Krondor-The-Assassins-The-Riftwar-Legacy-2-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/2097096092099097/A-Kingdom-Besieged-The-Chaoswar-Saga-1-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/1096096093098090/Jimmy-the-Hand-Legends-of-the-Riftwar-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/8099094093094093/A-Senhora-do-Imp-rio-The-Empire-Trilogy-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3098097097094/A-Darkness-At-Sethanon-The-Riftwar-Saga-4-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3096095097095/Magician-Apprentice-The-Riftwar-Saga-1-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/1097092097090097/Raymond-E-Feist-s-Magician-Master-The-Great-One-by-Bryan-J-L-Glass.pdf
    • http://loaminoo.linkpc.net/5098094093096097/The-Riftwar-Legacy-The-Complete-4-Book-Collection-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/8094093099093/Talon-of-the-Silver-Hawk-Conclave-of-Shadows-1-by-Raymond-E-Feist.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.