Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ba6289303c22083…

MALICIOUS

PDF

13.9 KB Created: 2019-04-30 02:56:26 +01:00 Authoring application: mPDF 5.7
MD5: 3f1290f4935cd196dc6f3d1b2866af2d SHA-1: 2e0ee6c5d5ae2c18701e4bf02f0b548f6ea38a21 SHA-256: 0ba6289303c2208303de4284269799238c2cd5910de149a4c0c82ddf8bb42075
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains a large number of embedded URLs, identified as a link farm. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the sheer volume of links suggests an attempt to direct users to potentially malicious external content, possibly for SEO poisoning or to distribute further malware. The URLs themselves appear to be benign, but the pattern is suspicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4096096099095/Shadow-Wolf-Wolves-of-the-Beyond-2-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/3094092094098093/Watch-Wolf-Wolves-of-the-Beyond-3-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/6099092090098/Ashes-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/4098096098091093/Memoirs-of-a-Bookbat-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/1090096097098091/Hannah-Daughters-of-the-Sea-1-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/3092094090097091/Broken-Song-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/2093098097095099/True-North-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/6090091094094090/Les-Gardiens-de-Ga-Hoole---tome-2-02-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/1090090099095093096/Die-Legende-der-W-chter-15-Die-Entscheidung-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/4097098093099/To-Be-a-King-Guardians-of-Ga-Hoole-11-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/5098099097093099/Der-Clan-der-W-lfe-4-Eisk-nig-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/4091098098092/The-Hatchling-Guardians-of-Ga-Hoole-7-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/4097094096099/Exile-Guardians-of-Ga-Hoole-14-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/4091098093096/The-War-of-the-Ember-Guardians-of-Ga-Hoole-15-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/2094091098096099/Double-Trouble-Squared-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/1094093096092092/The-Man-Who-Made-Time-Travel-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/6090091094092091/Les-Gardiens-de-Ga-Hoole---tome-1-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/4097098090092/The-First-Collier-Guardians-of-Ga-Hoole-9-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/3099091099091/The-Shattering-Guardians-of-Ga-Hoole-5-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/2093096098093090/Christmas-After-All-The-Diary-of-Minnie-Swift-by-Kathryn-Lasky.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.