Malicious PDF — malware analysis report

Static analysis result for SHA-256 202c8215b9c2e88c…

MALICIOUS

PDF

15.7 KB Created: 2019-04-30 19:05:35 +01:00 Authoring application: mPDF 5.7
MD5: df4deae4eac47ed7d48254d7ba61324b SHA-1: eb0d82d483fba36965450d3490304947124186c1 SHA-256: 202c8215b9c2e88c04f1a2090c5cf044300c7abf10e4bdefea2c7caf8878f8de
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF contains a large number of embedded URLs, identified as a link farm. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be SEO poisoning or a similar technique to drive traffic to external sites. No scripts were extracted, and the document body was heavily corrupted, limiting further analysis.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9778

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4095094090098094/Half-Blood-Princess-Blood-Claim--Resurrection-Stone--Shadowed-Memories--Dark-Soul-by-Magen-McMinimy.pdf
    • http://loaminoo.linkpc.net/3095096097091098/Immortal-Blood-Immortal-Heart-1-by-Magen-McMinimy.pdf
    • http://loaminoo.linkpc.net/1098092091091090/Blood-Stone-Blood-Stone-2-by-Tracy-Cooper-Posey.pdf
    • http://loaminoo.linkpc.net/2090096093094090/Broken-Promise---Blood-Drops-Blood-Stone-1-2-by-Tracy-Cooper-Posey.pdf
    • http://loaminoo.linkpc.net/2091098099095092/Dark-Banquet-Blood-and-the-Curious-Lives-of-Blood-Feeding-Creatures-by-Bill-Schutt.pdf
    • http://loaminoo.linkpc.net/2096090097093099/Blood-Resurrection-My-Vampire-and-I-4-by-J-P-Bowie.pdf
    • http://loaminoo.linkpc.net/3090090092097/Half-Blood-Blues-by-Esi-Edugyan.pdf
    • http://loaminoo.linkpc.net/3098090093099093/Blood-and-Stone-Alastair-Stone-Chronicles-6-by-R-L-King.pdf
    • http://loaminoo.linkpc.net/3091093094096090/Blood-Kin-The-Half-Light-City-2-by-M-J-Scott.pdf
    • http://loaminoo.linkpc.net/7093098090091/Half-Blood-Covenant-1-by-Jennifer-L-Armentrout.pdf
    • http://loaminoo.linkpc.net/3092098093090/Half-Blood-Covenant-1-by-Jennifer-L-Armentrout.pdf
    • http://loaminoo.linkpc.net/6095093090090091/Half-Blood-Covenant-1-by-Jennifer-L-Armentrout.pdf
    • http://loaminoo.linkpc.net/9093098095096/Half-Blood-Ilyon-Chronicles-1-5-by-Jaye-L-Knight.pdf
    • http://loaminoo.linkpc.net/7090092099094/The-Weight-of-Blood-The-Half-Orcs-1-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/2091093095098097/Braced2Bite-Half-Blood-Vampires-1-by-Serena-Robar.pdf
    • http://loaminoo.linkpc.net/3091096097097098/Blood-of-Half-Gods-Witch-Fairy-5-by-Bonnie-Lamer.pdf
    • http://loaminoo.linkpc.net/5092098094094093/Dating-for-Demons-Half-Blood-Vampires-3-by-Serena-Robar.pdf
    • http://loaminoo.linkpc.net/3090096097096097/Tales-from-the-Half-Continent-Monster-Blood-Tattoo-3-5-by-D-M-Cornish.pdf
    • http://loaminoo.linkpc.net/3092096097096099/Princess-of-Blood-The-God-Fragments-2-by-Tom-Lloyd.pdf
    • http://loaminoo.linkpc.net/1097093095096096/Of-Royal-Blood-In-Pursuit-of-a-Princess-by-Carolyn-Zane.pdf
    • http://loaminoo.linkpc.net/30910930940960

Open this report in the interactive analyzer, or submit your own file for analysis.