Malicious PDF — malware analysis report

Static analysis result for SHA-256 13f3b16fa915a2f7…

MALICIOUS

PDF

14.9 KB Created: 2019-05-07 08:32:20 +01:00 Authoring application: mPDF 5.7
MD5: ef3bf0a61a9f1665338e3f219aca6e8e SHA-1: 0be5ff97d16a07ae682e974b5aef88f279b5dcf5 SHA-256: 13f3b16fa915a2f79abe564b2ee3464e63400de8bab3ee3afea442827a37503e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files hosted on a dynamic DNS domain. This is indicative of a link farm or a method to distribute further content, potentially malicious. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090090093090097094/Tschitti---Das-Wunderauto-fliegt-wieder-by-Frank-Cottrell-Boyce.pdf
    • http://loaminoo.linkpc.net/1090090093090090096/Tschitti---Im-Wettrennen-gegen-die-Zeit-by-Frank-Cottrell-Boyce.pdf
    • http://loaminoo.linkpc.net/3092091097091/Cosmic-by-Frank-Cottrell-Boyce.pdf
    • http://loaminoo.linkpc.net/1091091091099098/Millions-by-Frank-Cottrell-Boyce.pdf
    • http://loaminoo.linkpc.net/3091098096097/The-Unforgotten-Coat-by-Frank-Cottrell-Boyce.pdf
    • http://loaminoo.linkpc.net/3091097095092/Sputnik-s-Guide-to-Life-on-Earth-by-Frank-Cottrell-Boyce.pdf
    • http://loaminoo.linkpc.net/8094094093094093/Chitty-Chitty-Bang-Bang-Flies-Again-Chitty-Chitty-Bang-Bang-2-by-Frank-Cottrell-Boyce.pdf
    • http://loaminoo.linkpc.net/1091090093093092093/Was-fliegt-denn-da-Das-Original-by-Peter-H-Barthel.pdf
    • http://loaminoo.linkpc.net/1091090093093092096/Nashira-Roman-Heyne-fliegt-by-Licia-Troisi.pdf
    • http://loaminoo.linkpc.net/8092090094096093/The-Bull-of-Minos-by-Leonard-Cottrell.pdf
    • http://loaminoo.linkpc.net/7099091090091096/Far-From-Home-Mangrove-Island-2-by-Neve-Cottrell.pdf
    • http://loaminoo.linkpc.net/7093096099090099/The-War-for-Ireland-1913-1923-by-Peter-James-Cottrell.pdf
    • http://loaminoo.linkpc.net/7099091090091090/Long-Way-Home-A-Mangrove-Island-Novel-1-by-Neve-Cottrell.pdf
    • http://loaminoo.linkpc.net/6092098099092/Furniture-Of-The-New-Zealand-Colonial-Era-An-Illustrated-History-1830-1900-by-William-Cottrell.pdf
    • http://loaminoo.linkpc.net/4094092099098092/Okay-Okay-by-Melinda-Tracy-Boyce.pdf
    • http://loaminoo.linkpc.net/2097092097095096/The-Herbalist-by-Niamh-Boyce.pdf
    • http://loaminoo.linkpc.net/1099092091091097/Once-a-Duchess-by-Elizabeth-Boyce.pdf
    • http://loaminoo.linkpc.net/5091099095095/Treason-The-Grimoire-Saga-2-by-S-M-Boyce.pdf
    • http://loaminoo.linkpc.net/5095091090093/Lichgates-The-Grimoire-Saga-1-by-S-M-Boyce.pdf
    • http://loaminoo.linkpc.net/3093094098098096/Lichgates-Grimoire-Saga-1-by-S-M-Boyce.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.