Malicious PDF — malware analysis report

Static analysis result for SHA-256 0dc080463fa91839…

MALICIOUS

PDF

13.4 KB Created: 2019-05-02 01:45:53 +01:00 Authoring application: mPDF 5.7
MD5: c65a73709f041b0c137f9a37f99b6931 SHA-1: a41a4f13e18fb5b21a379f0f07ead02ab23337c6 SHA-256: 0dc080463fa918399c38fa37ccf07df24244e305cfaacedd4ee2c5633af4f3e5
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF containing a large number of embedded URLs, identified as a link farm. While the URLs themselves are marked as benign, the sheer volume and the heuristic firing of PDF_SEO_LINK_FARM indicate a suspicious pattern. The ML classifier also flagged this PDF as malicious, suggesting it's part of a larger malicious operation, potentially for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9877

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2099092095098098/His-Dakota-Heart-Dakota-Hearts-7-by-Lisa-Mondello.pdf
    • http://loaminoo.linkpc.net/2090095099095097/Dakota-Ranch-Crude-Dakota-Heat-2-by-Leah-Brooke.pdf
    • http://loaminoo.linkpc.net/2090090092099096/Dakota-Born-Dakota-1-by-Debbie-Macomber.pdf
    • http://loaminoo.linkpc.net/4095098093096099/The-More-I-See-Texas-Hearts-3-by-Lisa-Mondello.pdf
    • http://loaminoo.linkpc.net/4097096097094097/Leaving-Liberty-Texas-Hearts-5-by-Lisa-Mondello.pdf
    • http://loaminoo.linkpc.net/5090094099093093/Seeing-You-by-Dakota-Flint.pdf
    • http://loaminoo.linkpc.net/2094094092091099/Just-Between-Friends-by-Dakota-Trace.pdf
    • http://loaminoo.linkpc.net/3095099090093095/Dakota-by-Todd-Brown.pdf
    • http://loaminoo.linkpc.net/1090098094096094096/Dakota-Eifel-by-R-D-Fritschen.pdf
    • http://loaminoo.linkpc.net/5090091096097092/His-Dakota-Captive-by-Jenna-Kernan.pdf
    • http://loaminoo.linkpc.net/9093093091095096/F-r-ein-einziges-L-cheln-by-Kate-Dakota.pdf
    • http://loaminoo.linkpc.net/4097097092094091/Dungeon-Desolation-by-Dakota-Krout.pdf
    • http://loaminoo.linkpc.net/6090094094099099/Dreamcatcher-Dakota-Wolves-2-by-Jez-Strider.pdf
    • http://loaminoo.linkpc.net/2095093090092/Dakota-Marshal-by-Jenna-Ryan.pdf
    • http://loaminoo.linkpc.net/1093092090091091/Community-Service-by-Dakota-Madison.pdf
    • http://loaminoo.linkpc.net/2096093095098097/The-Accidental-Dragon-Accidentals-9-by-Dakota-Cassidy.pdf
    • http://loaminoo.linkpc.net/3098095090092097/Buffalo-Valley-Dakota-4-by-Debbie-Macomber.pdf
    • http://loaminoo.linkpc.net/4097096099093099/Nazareth-North-Dakota-by-Tommy-Zurhellen.pdf
    • http://loaminoo.linkpc.net/7098097090093/Accidentally-Dead-Accidentals-2-by-Dakota-Cassidy.pdf
    • http://loaminoo.linkpc.net/4095097096098094/Talk-This-Way-Plum-Orchard-0-5-by-Dakota-Cassidy.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.