Malicious PDF — malware analysis report

Static analysis result for SHA-256 247092f9aee7faa4…

MALICIOUS

PDF

16.8 KB Created: 2019-04-30 04:14:37 +01:00 Authoring application: mPDF 5.7
MD5: 9fb7bb948e418e313987f443d2ca2a59 SHA-1: 37fb086baa8951b4750a7aa8c9cc101cfb87f080 SHA-256: 247092f9aee7faa4d8f4e32625ed85310e321e762db821ff630051c35b19ddef
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded links to external websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to serve as a landing page for further malicious activity. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8093090091095094/The-Bone-Sword-Cycle-of-Malik-1-by-Walter-Rhein.pdf
    • http://loaminoo.linkpc.net/1095098093099090/Nine-Heroes-Tales-of-Heroic-Fantasy-by-Walter-Rhein.pdf
    • http://loaminoo.linkpc.net/1092097098093093/Walter-and-the-Sword-of-Stupidity-Book-Three-of-the-Elderly-Chronicles-by-T-S-Brothers.pdf
    • http://loaminoo.linkpc.net/1095091091091093/Bone-by-Bone-Comparing-Animal-Skeletons-by-Sara-Levine.pdf
    • http://loaminoo.linkpc.net/2094091094091094/Bone-Vol-9-Crown-of-Horns-Bone-9-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/4093095099091/Bone-Vol-3-Eyes-of-the-Storm-Bone-3-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/1098094092095099/Bone-Vol-8-Treasure-Hunters-Bone-8-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/4094092094093/Bone-Vol-2-The-Great-Cow-Race-Bone-2-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/1098094092095098/Bone-Vol-9-Crown-of-Horns-Bone-9-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/3095099093096/Bone-Vol-1-Out-from-Boneville-Bone-1-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/6095099095099/Bone-Vol-4-The-Dragonslayer-Bone-4-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/4090094095099099/Voice-of-the-Sword-Sword-Mirror-Jewel-Trilogy-1-by-John-Paul-Catton.pdf
    • http://loaminoo.linkpc.net/6099099096095095/Fire-and-Sword-Sword-and-Sorcery-1-by-Dylan-Doose.pdf
    • http://loaminoo.linkpc.net/8099093098090/The-Secret-of-the-Sword-The-Sword-of-Shannara-3-by-Terry-Brooks.pdf
    • http://loaminoo.linkpc.net/3098093095092095/Sword-and-Shadow-Sword-in-Exile-3-by-Ann-Marston.pdf
    • http://loaminoo.linkpc.net/1091096097091096090/Rhein-Impressionen-Historische-Photos-Vom-Niederrhein-by-Meinhard-Pohl.pdf
    • http://loaminoo.linkpc.net/1091097097096093090/Party-in-Ausfahrt-CHRONICLES-OF-RHEIN-MAIN-AIR-BASE-by-Dick-Darm.pdf
    • http://loaminoo.linkpc.net/1091095094096091090/Wilde-Tage-am-Rhein-Die-Camping-Ficker-und-der-Hellseher-by-Heinz-Peter-Tjaden.pdf
    • http://loaminoo.linkpc.net/1091096099091093094/Traumpfade---Jubil-umsausgabe-27-Premium-Rundwege-am-Rhein-an-der-Mosel-und-in-der-Eifel-by-Ulrike-Poller.pdf
    • http://loaminoo.linkpc.net/4097097090092099/Is-It-Wrong-to-Try-to-Pick-Up-Girls-in-a-Dungeon-On-the-Side-Sword-Oratoria-Vol-1-DanMachi-Sword-Oratoria-Light-Novel-1-by-Fujino-mori.pdf
    • http://loaminoo.linkpc.net/4090094095099099/Voice-

Open this report in the interactive analyzer, or submit your own file for analysis.