Malicious PDF — malware analysis report

Static analysis result for SHA-256 11d9e014a6e0bc45…

MALICIOUS

PDF

16.0 KB Created: 2019-04-30 04:19:12 +01:00 Authoring application: mPDF 5.7
MD5: 560b94eb85d792ac9529319e57fd1839 SHA-1: 37e78568ed897e740b5f60c7cdf1f2b0e703708d SHA-256: 11d9e014a6e0bc45c8a8008c3365298a261775488c0408996a2e24734147dba2
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of embedded links to external PDF files hosted on a dynamic DNS domain, identified by the PDF_SEO_LINK_FARM heuristic. While the ML classifier also flagged the document as malicious, the specific intent appears to be the distribution of content via these links, rather than direct execution of a payload from this file. The URLs themselves are not directly malicious but serve as a distribution mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1097095092096090/Glyphotech-by-Mark-Samuels.pdf
    • http://loaminoo.linkpc.net/9096091094095/The-White-Hands-and-Other-Weird-Tales-by-Mark-Samuels.pdf
    • http://loaminoo.linkpc.net/3095097095092094/Shadows-of-Darkness-by-Mark-A-Roeder.pdf
    • http://loaminoo.linkpc.net/2093091097096/Henry-Adams-by-Ernest-Samuels.pdf
    • http://loaminoo.linkpc.net/6092092091091099/Aloha-Dolores-by-Barbara-Samuels.pdf
    • http://loaminoo.linkpc.net/4092097095098094/Unique-Different-Found-Nightfall-1-by-Violet-Samuels.pdf
    • http://loaminoo.linkpc.net/3097096091099/Unique-Different-Found-Nightfall-1-by-Violet-Samuels.pdf
    • http://loaminoo.linkpc.net/8097098095095/Anybody-s-Daughter-Angela-Evans-2-by-Pamela-Samuels-Young.pdf
    • http://loaminoo.linkpc.net/1094096094099090/Mysterious-Discovered-Accepted-Nightfall-3-by-Violet-Samuels.pdf
    • http://loaminoo.linkpc.net/1095099097098/Henry-Adams-The-Major-Phase-by-Ernest-Samuels.pdf
    • http://loaminoo.linkpc.net/3093097096091090/Anybody-s-Daughter-Angela-Evans-2-by-Pamela-Samuels-Young.pdf
    • http://loaminoo.linkpc.net/2095091092093096/Unique-Different-Found-The-Prologue-Nightfall-0-5-by-Violet-Samuels.pdf
    • http://loaminoo.linkpc.net/3095090091096092/Enlightened-by-Darkness---Vol-3-As-Darkness-Spreads-Enlightened-By-Darkness-3-by-Robert-Friedrich.pdf
    • http://loaminoo.linkpc.net/3096093096097093/Healing-with-the-Arts-A-12-Week-Program-to-Heal-Yourself-and-Your-Community-by-Michael-Samuels.pdf
    • http://loaminoo.linkpc.net/2099099099091097/Prince-Duncan-and-the-Playboy-Royal-Mates-Love-s-Diamond-6-by-Lyssa-Samuels.pdf
    • http://loaminoo.linkpc.net/2099099094097090/Prince-Magnus-and-the-Carpenter-Royal-Mates-Love-s-Diamond-2-by-Lyssa-Samuels.pdf
    • http://loaminoo.linkpc.net/2099099093095096/King-Merek-and-the-Mechanic-Royal-Mates-Love-s-Diamond-1-by-Lyssa-Samuels.pdf
    • http://loaminoo.linkpc.net/1098091098094090/Darkness-Torn-Asunder-Paladins-of-Darkness-9-5-by-Alexis-Morgan.pdf
    • http://loaminoo.linkpc.net/1093092097097096/Darkness-of-Light-Darkness-1-by-Stacey-Marie-Brown.pdf
    • http://loaminoo.linkpc.net/1091099093092092/Defeat-the-Darkness-Hearts-of-Darkness-1-by-Eliza-March.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.