Malicious PDF — malware analysis report

Static analysis result for SHA-256 23dbc6cea89d84d5…

MALICIOUS

PDF

17.3 KB Created: 2019-04-30 02:44:28 +01:00 Authoring application: mPDF 5.7
MD5: de01be191ff8862a9e2db1f63c1097e5 SHA-1: 7cade40516cd37601b0a149fdfa1821acfdca0c2 SHA-256: 23dbc6cea89d84d57a921dc33dba5ef0e104b86235ad870ae74abb6a88aa3e80
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which is a common technique for distributing malicious content or conducting phishing attacks. The ML classifier also strongly indicated maliciousness. While the specific URLs extracted were labeled as confirmed_benign, the sheer volume and structure of the link farm suggest a malicious intent, potentially to bypass initial URL reputation checks or to serve as a lure for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2092097097098092/Maybe-the-Moon-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/1096097098091098/The-Night-Listener-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/1099099096098/Sure-of-You-Tales-of-the-City-6-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/1099094095091091/Babycakes-Tales-of-the-City-4-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/1090091091092098/Significant-Others-Tales-of-the-City-5-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/9097097092096097/Armistead-Maupin-s-More-Tales-of-the-City-by-Kevin-Tierney.pdf
    • http://loaminoo.linkpc.net/1095099090095091/The-Days-of-Anna-Madrigal-Tales-of-the-City-9-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/9097097094098097/Tales-of-the-City-by-Armistead-Maupin-Summary-amp-Study-Guide-by-BookRags.pdf
    • http://loaminoo.linkpc.net/9090091092096095/Die-Tage-der-Anna-Madrigal-Die-letzten-Stadtgeschichten-Tales-of-the-City-9-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/9097097093093097/Dogs-We-Love-With-Jane-Smiley-Armistead-Maupin-Ann-Beattie-Edward-Albee-and-14-Other-Dog-People-by-Michael-J-Rosen.pdf
    • http://loaminoo.linkpc.net/8091094093096091/Anges-batailleurs-Les-crivains-gays-en-Am-rique-de-Tennessee-Williams-Armistead-Maupin-Essais-Etranger-by-Christopher-Bram.pdf
    • http://loaminoo.linkpc.net/8092096090092/The-Complete-Tales-of-the-City-Tales-of-the-City-1-6-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/4096099091093095/More-Tales-of-the-City-Tales-of-the-City-2-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/2091097099097094/More-Tales-of-the-City-Tales-of-the-City-2-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/3093093095096/Tales-of-the-City-Tales-of-the-City-1-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/9099095099094/More-Tales-of-the-City-Tales-of-the-City-2-by-Armistead-Maupin.pdf
    • http://loaminoo.linkpc.net/1091095098094098090/Robin-Aroon-a-Comedy-of-Manners-by-Armistead-C-Armistead-Churchil-Gordon.pdf
    • http://loaminoo.linkpc.net/1091095098093098099/The-Armistead-Family-1635-1910-by-Garber-Virginia-Armistead.pdf
    • http://loaminoo.linkpc.net/2098096095097/Autumn-in-the-City-of-Angels-Autumn-1-by-Kirby-Howell.pdf
    • http://loaminoo.linkpc.net/3093090093096093/Autumn-Autumn-1-by-David-Moody.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.