Malicious PDF — malware analysis report

Static analysis result for SHA-256 24a649f9d98a9421…

MALICIOUS

PDF

17.7 KB Created: 2019-04-30 17:41:08 +01:00 Authoring application: mPDF 5.7
MD5: 1da8fcad383dbd960ec0d9e9bbf55e2e SHA-1: 1c810d7d80dae6811e71e1e6f2f203982d05c52b SHA-256: 24a649f9d98a942125b9aca4269d26214a8c0e9b166a237351f7ed917b9676de
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves directing users to a link farm, likely to host further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo
    • http://loaminoo.linkpc.net/1092099094097094/Midnight-Rising-John-Brown-and-the-Raid-That-Sparked-the-Civil-War-by-Tony-Horwitz.pdf
    • http://loaminoo.linkpc.net/1099091097099091/One-for-the-Road-An-Outback-Adventure-by-Tony-Horwitz.pdf
    • http://loaminoo.linkpc.net/1098095090090092/John-Brown-Rose-and-the-Midnight-Cat-by-Jenny-Wagner.pdf
    • http://loaminoo.linkpc.net/2096097095091094/A-Voyage-Long-and-Strange-On-the-Trail-of-Vikings-Conquistadors-Lost-Colonists-and-Other-Adventurers-in-Early-America-by-Tony-Horwitz.pdf
    • http://loaminoo.linkpc.net/3095097094093097/Midnight-Rising-Midnight-Breed-4-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/5090095097095099/Red-Rising-Red-Rising-Trilogy-1-by-Pierce-Brown.pdf
    • http://loaminoo.linkpc.net/9092091097093095/Raid-On-Truman-by-John-T-Campbell.pdf
    • http://loaminoo.linkpc.net/2095095092096091/Freedom-Rising-Washington-in-the-Civil-War-by-Ernest-B-Furgurson.pdf
    • http://loaminoo.linkpc.net/8095090094098096/Digging-for-Mrs-Miller-Some-Experiences-of-an-Air-Raid-Warden-by-John-Strachey.pdf
    • http://loaminoo.linkpc.net/3091094090097098/Carried-Away-by-Sue-Civil-Brown.pdf
    • http://loaminoo.linkpc.net/5091098098098091/Civil-Wars-by-Rosellen-Brown.pdf
    • http://loaminoo.linkpc.net/3091094090098090/Letting-Loose-by-Sue-Civil-Brown.pdf
    • http://loaminoo.linkpc.net/2097090095096098/Chasing-Rainbow-by-Sue-Civil-Brown.pdf
    • http://loaminoo.linkpc.net/4098092091096098/The-Prince-Next-Door-by-Sue-Civil-Brown.pdf
    • http://loaminoo.linkpc.net/4098092091096095/Next-Stop-Paradise-by-Sue-Civil-Brown.pdf
    • http://loaminoo.linkpc.net/6/Golden-Son-Red-Rising-2-by-Pierce-Brown.pdf
    • http://loaminoo.linkpc.net/2094094098097093/Golden-Son-Red-Rising-2-by-Pierce-Brown.pdf
    • http://loaminoo.linkpc.net/4099091097091097/Temperatures-Rising-by-Sandra-Brown.pdf
    • http://loaminoo.linkpc.net/9098096093/Rising-Strong-by-Bren-Brown.pdf
    • http://loaminoo.linkpc.net/4094094091097099/The-Dark-Warrior-Series-The-Complete-Collection-Contains-Midnight-s-Master-Midnight-s-Lover-Midnight-s-Seduction-Midnight-s-Warrior-Midnight-s-Kiss-Surrender-novella-Dark-Warriors-by-Donna-Grant.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.