Malicious PDF — malware analysis report

Static analysis result for SHA-256 21f2d11fbca8c98f…

MALICIOUS

PDF

14.3 KB Created: 2019-05-01 23:37:32 +01:00 Authoring application: mPDF 5.7
MD5: a47faa34f61c9d6bf84ca061748e7269 SHA-1: bbff5e7e1e0562072cc6f7f80e5e0aa91747d4ea SHA-256: 21f2d11fbca8c98f7d9754e79f7c64b4e944b48b3b3dff7bb33e74728fea80a0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a link farm or redirection tactic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The embedded URLs, while appearing to link to books, are likely part of a scheme to direct users to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4095092096094092/A-Dance-of-Mirrors-Shadowdance-3-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/4096095090097091/A-Dance-of-Cloaks-Shadowdance-1-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/2098092099094099/A-Dance-of-Chaos-Shadowdance-6-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/5091090094097/A-Dance-of-Cloaks-Shadowdance-1-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/1098091092093097/A-Dance-of-Mirrors-Shadowdance-3-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/2090097096094090/A-Dance-of-Ghosts-Shadowdance-5-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/2095090094090090/A-Dance-of-Shadows-Shadowdance-4-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/3090091096096095/The-Old-Ways-The-Paladins-3-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/1098092096090091/Clash-of-Faiths-The-Paladins-2-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/6099090098098/The-Cost-of-Betrayal-The-Half-Orcs-2-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/6096091095099/The-Shadows-of-Grace-The-Half-Orcs-4-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/7090092099094/The-Weight-of-Blood-The-Half-Orcs-1-by-David-Dalglish.pdf
    • http://loaminoo.linkpc.net/2096093099093098/The-Dance-of-Death-by-August-Strindberg.pdf
    • http://loaminoo.linkpc.net/5095090096092095/A-Wild-Sheep-Chase-Dance-Dance-Dance-The-Rat-3-4-by-Haruki-Murakami.pdf
    • http://loaminoo.linkpc.net/2094093092097091/Dance-of-Death-Fear-Street-Sagas-8-by-R-L-Stine.pdf
    • http://loaminoo.linkpc.net/1090098094095098093/A-Dance-with-Death-Soviet-Airwomen-in-World-War-II-by-Anne-Noggle.pdf
    • http://loaminoo.linkpc.net/8098090095099093/Play-Strindberg-The-Dance-of-Death-Choreographed-by-Friedrich-D-rrenmatt.pdf
    • http://loaminoo.linkpc.net/6093094094094/Slaughterhouse-five-The-Children-s-Crusade-A-Duty-dance-with-Death-by-Kurt-Vonnegut.pdf
    • http://loaminoo.linkpc.net/2093092092096092/The-Dance-of-Death-in-the-Middle-Ages-Image-Text-Performance-by-Elina-Gertsman.pdf
    • http://loaminoo.linkpc.net/2098099094099093/Owl-Dance-by-David-Lee-Summers.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.