Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ea6aed17e2a7861…

MALICIOUS

PDF

15.5 KB Created: 2019-05-06 16:58:46 +01:00 Authoring application: mPDF 5.7
MD5: b3d08787338b9f2f1317c31d9cb42d17 SHA-1: 72c1ffa239056feeec47873377eec92fd238fd47 SHA-256: 1ea6aed17e2a7861de4d2508d0b7b9766a58d462f8c1a55caaeac8bdee0b57af
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently classified as benign, the sheer volume and the heuristic firing of PDF_SEO_LINK_FARM indicate a malicious intent, likely for SEO manipulation or to serve as a distribution point for further malicious content. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9096090092090090/House-of-Mystery-Wenn-W-nde-sprechen-k-nnten-House-of-Mystery-3-by-Matthew-Sturges.pdf
    • http://loaminoo.linkpc.net/5090091098094091/In-the-Bleak-Midwinter-by-Patricia-Hall.pdf
    • http://loaminoo.linkpc.net/2097093098097091/A-Midwinter-Ball-by-Heidi-Ashworth.pdf
    • http://loaminoo.linkpc.net/3090098098095/The-Wolves-of-Midwinter-by-Anne-Rice.pdf
    • http://loaminoo.linkpc.net/3096095091092091/In-the-Bleak-Midwinter-by-Andra-Brynn.pdf
    • http://loaminoo.linkpc.net/1094095099099090/A-Duke-for-Midwinter-by-Anthea-Lawson.pdf
    • http://loaminoo.linkpc.net/3096092096091096/Moominland-Midwinter-The-Moomins-6-by-Tove-Jansson.pdf
    • http://loaminoo.linkpc.net/3097099091097095/A-Midwinter-s-Tale-Family-Saga-2-by-Andrew-M-Greeley.pdf
    • http://loaminoo.linkpc.net/4090097091098093/Midwinter-of-the-Spirit-Merrily-Watkins-2-by-Phil-Rickman.pdf
    • http://loaminoo.linkpc.net/1097091097090099/Midwinter-Night-s-Dream-Unwrapping-Hank-2-by-Eli-Easton.pdf
    • http://loaminoo.linkpc.net/3096096093093095/Midwinter-Nightingale-The-Wolves-Chronicles-10-by-Joan-Aiken.pdf
    • http://loaminoo.linkpc.net/7095093099093097/A-Malm-Midwinter-Inspector-Anita-Sundstrom-4-5-by-Torquil-MacLeod.pdf
    • http://loaminoo.linkpc.net/4096099097097090/A-Midwinter-Fantasy-Strangely-Beautiful-2-5-Sylph-2-5-The-Magic-Knot-3-by-Leanna-Renee-Hieber.pdf
    • http://loaminoo.linkpc.net/2096098096097/In-the-Bleak-Midwinter-The-Rev-Clare-Fergusson-amp-Russ-Van-Alstyne-Mysteries-1-by-Julia-Spencer-Fleming.pdf
    • http://loaminoo.linkpc.net/4095093093097091/The-Lost-Prince-A-Midwinter-Prince-2-by-Harper-Fox.pdf
    • http://loaminoo.linkpc.net/4093092097093/Matthew-Henry-s-Commentary-on-the-Whole-Bible-by-Matthew-Henry.pdf
    • http://loaminoo.linkpc.net/8096098095095/Cat-by-Matthew-Van-Fleet.pdf
    • http://loaminoo.linkpc.net/4091097091093099/ABC-by-Matthew-Porter.pdf
    • http://loaminoo.linkpc.net/5098093098094095/Matthew-by-R-C-Sproul.pdf
    • http://loaminoo.linkpc.net/2092092099097099/Big-Man-by-Matthew-J-Metzger.pdf
    • http://loaminoo.linkpc.net/4096099097097090/A-Midwinter-Fantasy-Strangely-Beautif

Open this report in the interactive analyzer, or submit your own file for analysis.