Malicious PDF — malware analysis report

Static analysis result for SHA-256 228b4298216d0788…

MALICIOUS

PDF

17.9 KB Created: 2019-05-02 17:56:18 +01:00 Authoring application: mPDF 5.7
MD5: c1de05a88f137e8d2d778bd6d1b5ab74 SHA-1: 53bff32560655b27946f63689129ae1593870fa1 SHA-256: 228b4298216d0788eacf1d6c2671f468b55bc2f53ea12d61db05e2d77bbd6518
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently classified as benign, the sheer volume and structure suggest a malicious intent, likely for SEO poisoning or to distribute further malicious content. The ML classifier strongly supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5097090094094091/The-Meditations-The-Wisdom-Collection-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/1091095098094090094/Meditations-of-Marcus-Aurelius---Enhanced-and-Hyper-Linked-Kindle-Edition-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/5095093093091093/The-Meditations-of-Marcus-Aurelius-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/4092096094095095/Meditations-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/3096093098094094/Meditations-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/5094098094092091/The-Meditations-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/1090091093096097093/Meditations-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/5094096092096091/Meditations-Thoughts-to-Myself-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/2096094095092090/Meditations-A-New-Translation-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/7090091097097094/Meditations-New-Edition-with-Photos-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/6093099090099094/The-Inner-Citadel-The-Meditations-of-Marcus-Aurelius-by-Pierre-Hadot.pdf
    • http://loaminoo.linkpc.net/7092098099090098/Meditations-Translated-from-the-Greek-by-Jeremy-Collier-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/7090092098095098/Meditations---With-Annotations---Barnes-And-Noble---ANNOTATED-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/5096090090096095/The-Meditations-of-the-Emperor-Marcus-Aurelius-Antoninus-by-Francis-Hutcheson.pdf
    • http://loaminoo.linkpc.net/6094092098094093/Marcus-Aurelius-Antoninus-to-Himself-An-English-Translation-With-Introductory-Study-on-Stoicism-and-the-Last-of-the-Stoics-1898-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/6090093090097092/The-Wisdom-of-the-Stoics-Selections-from-Seneca-Epictetus-and-Marcus-Aurelius-by-Frances-Hazlitt.pdf
    • http://loaminoo.linkpc.net/6093099090095097/Marcus-Aurelius-by-Frank-McLynn.pdf
    • http://loaminoo.linkpc.net/5093093097098094/Marc-Aur-le---Pens-es-pour-moi-m-me-by-Marcus-Aurelius.pdf
    • http://loaminoo.linkpc.net/6090093090097099/Lucretius-Epictetus-Marcus-Aurelius-Plotinus-Great-Books-of-the-Western-World-11-by-Lucretius.pdf
    • http://loaminoo.linkpc.net/6090093090097097/Plato-Epictetus-Marcus-Aurelius-by-Epictetus.pdf
    • http://loaminoo.linkpc.net/7092098

Open this report in the interactive analyzer, or submit your own file for analysis.