Malicious PDF — malware analysis report

Static analysis result for SHA-256 238bef7b8850ead3…

MALICIOUS

PDF

16.5 KB Created: 2019-04-30 05:04:49 +01:00 Authoring application: mPDF 5.7
MD5: efc3fa9811225a41de0b878dd7d2f1b2 SHA-1: 510ad53f6264c93cf08aa2f484174460abe8256c SHA-256: 238bef7b8850ead3f7b55fb5b5c5eaf3d2051bd5fb57b36ae73ba29883f7110f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified as a link farm. While the specific intent of these links is not fully clear due to the benign reputation of the initial ones, the heuristic 'PDF_SEO_LINK_FARM' strongly suggests a malicious purpose, likely for SEO manipulation or to distribute further malicious content. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6092096097095097/Origin-and-Identity-Essays-on-Svevo-and-Trieste-Essays-on-Svevo-and-Trieste-by-Elizabeth-Schachter.pdf
    • http://loaminoo.linkpc.net/6092096098095092/Zois-in-Nighttown-Prostitution-and-Syphilis-in-the-Trieste-of-James-Joyce-and-Italo-Svevo-by-Erik-Holmes-Schneider.pdf
    • http://loaminoo.linkpc.net/6090098099092094/Memoir-of-Italo-Svevo-by-Livia-Veneziani-Svevo.pdf
    • http://loaminoo.linkpc.net/4095092093096098/Zeno-s-Conscience-by-Italo-Svevo.pdf
    • http://loaminoo.linkpc.net/9097092093094097/Love-from-Trieste-by-Kirsten-Thorup.pdf
    • http://loaminoo.linkpc.net/6092096097096094/Gesammelte-Werke-In-Einzelausgaben-by-Italo-Svevo.pdf
    • http://loaminoo.linkpc.net/4091092095092090/A-Dead-Man-in-Trieste-Seymour-of-Special-Branch-1-by-Michael-Pearce.pdf
    • http://loaminoo.linkpc.net/5099098094094095/Mathias-Sandorf-Part-I-The-Conspirators-of-Trieste-Volume-2-by-Jules-Verne.pdf
    • http://loaminoo.linkpc.net/7098090098097097/Women-in-Dada-Essays-on-Sex-Gender-and-Identity-by-Naomi-Sawelson-Gorse.pdf
    • http://loaminoo.linkpc.net/4095097090095/The-Far-Islands-and-Other-Cold-Places-Travel-Essays-of-a-Victorian-Lady-by-Elizabeth-Taylor.pdf
    • http://loaminoo.linkpc.net/1090094097099090092/Bad-Feminist-Essays-by-Roxane-Gay.pdf
    • http://loaminoo.linkpc.net/3092093093099096/Dialogues-and-Essays-by-Seneca.pdf
    • http://loaminoo.linkpc.net/7090090094093093/Last-Essays-by-Georges-Bernanos.pdf
    • http://loaminoo.linkpc.net/7099099098093/Xylotheque-Essays-by-Yelizaveta-P-Renfro.pdf
    • http://loaminoo.linkpc.net/2091093093090/Less-Than-One-Selected-Essays-by-Joseph-Brodsky.pdf
    • http://loaminoo.linkpc.net/5096098091098095/Philosophical-Essays-by-Bertrand-Russell.pdf
    • http://loaminoo.linkpc.net/1099091096090/Fraud-Essays-by-David-Rakoff.pdf
    • http://loaminoo.linkpc.net/2095096099096096/Collected-Essays-by-Aldous-Huxley.pdf
    • http://loaminoo.linkpc.net/1094091097090090/Some-of-Us-Did-Not-Die-New-and-Selected-Essays-by-June-Jordan.pdf
    • http://loaminoo.linkpc.net/7095095091094095/The-Limits-of-Art-Two-Essays-by-Tzvetan-Todorov.pdf
    • http://loaminoo.linkpc.net/5099098094094095/Mathias-Sandorf-Part-I-The

Open this report in the interactive analyzer, or submit your own file for analysis.