Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f0a6f3b073ecb05…

MALICIOUS

PDF

13.4 KB Created: 2019-05-02 00:49:33 +01:00 Authoring application: mPDF 5.7
MD5: 3c32c02bc84b213e348ba4c09f68bf94 SHA-1: 8f88f21ef510fa852b37dd9677a33b2ff3381a91 SHA-256: 0f0a6f3b073ecb057eb4044c6c63181cbdfcdba7ce5fa379f58b4eac21095b33
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to what appear to be pirated books, indicating a link farm for potentially malicious content distribution. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were extracted, the heuristic 'PDF_SEO_LINK_FARM' strongly suggests the document's purpose is to redirect users to external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9877

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8097098090092/Corsair-The-Oregon-Files-6-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/2099096095092099/Dark-Watch-The-Oregon-Files-3-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/8097093099099/Sacred-Stone-The-Oregon-Files-2-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/2099096095093090/Skeleton-Coast-The-Oregon-Files-4-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1090094099099092/Skeleton-Coast-The-Oregon-Files-4-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/6098098090/Typhoon-Fury-The-Oregon-Files-12-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/8097099096097/Golden-Buddha-Sacred-Stone-The-Oregon-Files-1-2-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/8097095098099/The-Navigator-NUMA-Files-7-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4093091091091098/White-Death-NUMA-Files-4-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4095090094099094/Ghost-Ship-NUMA-Files-12-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1090090097098098/Polar-Shift-NUMA-Files-6-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4090095092091099/Piranha-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1093099096091099/Deep-Six-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/1090098090096090090/Incursi-n-nocturna-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/5090092090097092/The-Cutthroat-Isaac-Bell-10-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/3098091095098099/The-Bootlegger-Isaac-Bell-7-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4092098093094093/The-Tombs-Fargo-Adventure-4-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4098090095094/Dragon-Dirk-Pitt-10-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/4093091091092093/Deep-Six-Dirk-Pitt-7-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/8095099097094/Lost-Empire-Fargo-Adventure-2-by-Clive-Cussler.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.