Malicious PDF — malware analysis report

Static analysis result for SHA-256 22516976693a423c…

MALICIOUS

PDF

16.8 KB Created: 2019-05-02 01:25:36 +01:00 Authoring application: mPDF 5.7
MD5: b6c096e1f8acaa3b92f7ce57dc293e1b SHA-1: c967314dbc5a58d960a4ae7cbacc533e277af484 SHA-256: 22516976693a423c1739feff1d2478f78ebfe5ab979000d606ad4b8e0b0217db
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently classified as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO poisoning or to distribute further malware. The ML_NYX_PDF_MALICIOUS heuristic also strongly indicates maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8093090091095094/The-Bone-Sword-Cycle-of-Malik-1-by-Walter-Rhein.pdf
    • http://loaminoo.linkpc.net/1095098093099090/Nine-Heroes-Tales-of-Heroic-Fantasy-by-Walter-Rhein.pdf
    • http://loaminoo.linkpc.net/1092097098093093/Walter-and-the-Sword-of-Stupidity-Book-Three-of-the-Elderly-Chronicles-by-T-S-Brothers.pdf
    • http://loaminoo.linkpc.net/1095091091091093/Bone-by-Bone-Comparing-Animal-Skeletons-by-Sara-Levine.pdf
    • http://loaminoo.linkpc.net/2094091094091094/Bone-Vol-9-Crown-of-Horns-Bone-9-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/4093095099091/Bone-Vol-3-Eyes-of-the-Storm-Bone-3-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/1098094092095099/Bone-Vol-8-Treasure-Hunters-Bone-8-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/4094092094093/Bone-Vol-2-The-Great-Cow-Race-Bone-2-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/1098094092095098/Bone-Vol-9-Crown-of-Horns-Bone-9-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/3095099093096/Bone-Vol-1-Out-from-Boneville-Bone-1-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/6095099095099/Bone-Vol-4-The-Dragonslayer-Bone-4-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/4090094095099099/Voice-of-the-Sword-Sword-Mirror-Jewel-Trilogy-1-by-John-Paul-Catton.pdf
    • http://loaminoo.linkpc.net/6099099096095095/Fire-and-Sword-Sword-and-Sorcery-1-by-Dylan-Doose.pdf
    • http://loaminoo.linkpc.net/8099093098090/The-Secret-of-the-Sword-The-Sword-of-Shannara-3-by-Terry-Brooks.pdf
    • http://loaminoo.linkpc.net/3098093095092095/Sword-and-Shadow-Sword-in-Exile-3-by-Ann-Marston.pdf
    • http://loaminoo.linkpc.net/1091096097091096090/Rhein-Impressionen-Historische-Photos-Vom-Niederrhein-by-Meinhard-Pohl.pdf
    • http://loaminoo.linkpc.net/1091097097096093090/Party-in-Ausfahrt-CHRONICLES-OF-RHEIN-MAIN-AIR-BASE-by-Dick-Darm.pdf
    • http://loaminoo.linkpc.net/1091095094096091090/Wilde-Tage-am-Rhein-Die-Camping-Ficker-und-der-Hellseher-by-Heinz-Peter-Tjaden.pdf
    • http://loaminoo.linkpc.net/1091096099091093094/Traumpfade---Jubil-umsausgabe-27-Premium-Rundwege-am-Rhein-an-der-Mosel-und-in-der-Eifel-by-Ulrike-Poller.pdf
    • http://loaminoo.linkpc.net/4097097090092099/Is-It-Wrong-to-Try-to-Pick-Up-Girls-in-a-Dungeon-On-the-Side-Sword-Oratoria-Vol-1-DanMachi-Sword-Oratoria-Light-Novel-1-by-Fujino-mori.pdf
    • http://loaminoo.linkpc.net/4090094095099099/Voice-

Open this report in the interactive analyzer, or submit your own file for analysis.