Malicious PDF — malware analysis report

Static analysis result for SHA-256 2290d1b662fc7bd3…

MALICIOUS

PDF

17.7 KB Created: 2019-05-02 05:40:35 +01:00 Authoring application: mPDF 5.7
MD5: 2c0082ee1f777735d12742faaaa5f6bd SHA-1: 0fefb1449a7aa2e3d4393007792cad9a6d99386b SHA-256: 2290d1b662fc7bd3cbe50d9c4d646510b738d6aa2c8eb37af72ab20caded185f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded links, many of which point to external PDF files hosted on the same domain. This behavior is consistent with SEO link farming or a distribution mechanism for malicious content. The ML classifier's high confidence score supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2091091096096093/The-Caretaker-The-Sin-Bin-2-by-Dahlia-Donovan.pdf
    • http://loaminoo.linkpc.net/3093095097094093/The-Wanderer-The-Sin-Bin-1-by-Dahlia-Donovan.pdf
    • http://loaminoo.linkpc.net/2094092097097095/Forged-in-Flood-by-Dahlia-Donovan.pdf
    • http://loaminoo.linkpc.net/3094098098091093/Alicia-Blackbird-5-by-Dahlia-Donovan.pdf
    • http://loaminoo.linkpc.net/2097099094092094/Black-Dahlia-Avenger-II-Presenting-the-Follow-Up-Investigation-and-Further-Evidence-Linking-Dr-George-Hill-Hodel-to-Los-Angeles-s-Black-Dahlia-and-Other-1940s-Lone-Woman-Murders-by-Steve-Hodel.pdf
    • http://loaminoo.linkpc.net/2099095092091093/Donovan-s-Angel-Donovan-s-of-the-Delta-1-by-Peggy-Webb.pdf
    • http://loaminoo.linkpc.net/2097093092094092/Footprints-in-the-Sand-A-Piper-Donovan-Mystery-Piper-Donovan-Wedding-Cake-Mysteries-Book-3-by-Mary-Jane-Clark.pdf
    • http://loaminoo.linkpc.net/1099097098099097/The-Caretaker-by-Harold-Pinter.pdf
    • http://loaminoo.linkpc.net/2091098090093096/Timelock-Caretaker-3-by-David-Klass.pdf
    • http://loaminoo.linkpc.net/1092098094097090/The-Caretaker-by-Thomas-William-Simpson.pdf
    • http://loaminoo.linkpc.net/6094096097090098/Caretaker-Star-Trek-Voyager-1-by-L-A-Graf.pdf
    • http://loaminoo.linkpc.net/6098094099098095/Meurtre-Heron-s-Cove-T1---S-rie-Emma-Sharpe-et-Colin-Donovan-Emma-Sharpe-amp-Colin-Donovan-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/2092092097091/Help-Your-Dog-Fight-Cancer-What-Every-Caretaker-Should-Know-About-Canine-Cancer-by-Laurie-Kaplan.pdf
    • http://loaminoo.linkpc.net/1091098093099097091/Together-in-November-by-Dahlia-Rose.pdf
    • http://loaminoo.linkpc.net/3095098095097098/Behind-the-Scenes-by-Dahlia-Adler.pdf
    • http://loaminoo.linkpc.net/3096097091099097/Ablaze-by-Dahlia-Rose.pdf
    • http://loaminoo.linkpc.net/4095095097096095/Tex-Burnout-2-by-Dahlia-West.pdf
    • http://loaminoo.linkpc.net/2095090093092099/The-Preacher-s-Son-by-Dahlia-Rose.pdf
    • http://loaminoo.linkpc.net/1091099097093090099/The-Solemn-Vow-by-Bree-Dahlia.pdf
    • http://loaminoo.linkpc.net/2095090095094099/Forever-Yours-by-Dahlia-Rose.pdf
    • http://loaminoo.linkpc.net/20

Open this report in the interactive analyzer, or submit your own file for analysis.