Malicious PDF — malware analysis report

Static analysis result for SHA-256 24dff81a0a0fd369…

MALICIOUS

PDF

20.9 KB Created: 2019-04-30 20:13:29 +01:00 Authoring application: mPDF 5.7
MD5: 155a65d1677c461b1cc2232548df98cf SHA-1: 3b7eb98a2b63a8289544fe9d43aea4ef32e7e814 SHA-256: 24dff81a0a0fd369519e65fa0c606636de6ccf216d43bb366e623c53ea2004ee
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While the extracted URLs themselves are currently flagged as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO poisoning or to redirect users to further malicious content. The ML_NYX_PDF_MALICIOUS heuristic also strongly indicates maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9924

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4097094099093096/Starless-Night-Forgotten-Realms-Legacy-of-the-Drow-2-Legend-of-Drizzt-8-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/8092093096097/The-Legacy-Forgotten-Realms-Legacy-of-the-Drow-1-Legend-of-Drizzt-7-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/4097094099093098/The-Legacy-Forgotten-Realms-Legacy-of-the-Drow-1-Legend-of-Drizzt-7-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/1099091090099095/Sea-of-Swords-Forgotten-Realms-Paths-of-Darkness-4-Legend-of-Drizzt-13-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/1094092094090091/Sea-of-Swords-Forgotten-Realms-Paths-of-Darkness-4-Legend-of-Drizzt-13-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/3093097097091/Homeland-Forgotten-Realms-The-Dark-Elf-Trilogy-1-Legend-of-Drizzt-1-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/1091098095090094/The-Pirate-King-Forgotten-Realms-Transitions-2-Legend-of-Drizzt-18-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/2091094097094098/The-Crystal-Shard-Forgotten-Realms-Icewind-Dale-1-Legend-of-Drizzt-4-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/4092097091091/Streams-of-Silver-Forgotten-Realms-Icewind-Dale-2-Legend-of-Drizzt-5-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/3095095097093/The-Icewind-Dale-Trilogy-Collector-s-Edition-Forgotten-Realms-Icewind-Dale-1-3-Legend-of-Drizzt-4-6-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/1096097096098094/Icewind-Dale-Trilogy-Forgotten-Realms-Icewind-Dale-1-3-Legend-of-Drizzt-4-6-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/4092094097099099/Maestro-Homecoming-2-The-Legend-of-Drizzt-29-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/2092090090094099/The-Companions-The-Sundering-1-The-Legend-of-Drizzt-24-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/2094098098093097/Rise-of-the-King-Companions-Codex-2-Legend-of-Drizzt-26-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/6092092094094/Canticle-Forgotten-Realms-The-Cleric-Quintet-1-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/4096091094092/Road-of-the-Patriarch-Forgotten-Realms-The-Sellswords-3-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/4096092096093090/Streams-of-Silver-The-Graphic-Novel-Legend-of-Drizzt-The-Graphic-Novel-5-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/5096093093098/Paths-of-Darkness-Collector-s-Edition-Forgotten-Realms-Paths-of-Darkness-1-4-by-R-A-Salvatore.pdf
    • http://loaminoo.linkpc.net/3097094093094098/Realms-of-Magic-Forgotten-Realms-Anthologies-3-by-J-Robert-King.pdf
    • http://loaminoo.linkpc.net/2099095093094098/Realms-of-the-Dragons-Forgotten-Realms-Anthologies-9-by-Philip-Athans.pdf