Malicious PDF — malware analysis report

Static analysis result for SHA-256 292d3ec7ae0b09b6…

MALICIOUS

PDF

17.7 KB Created: 2019-04-30 05:04:13 +01:00 Authoring application: mPDF 5.7
MD5: 0f6653493d0d0412d4c27ff48c592ad8 SHA-1: 5a5cd057082d88ee087180cc0749174486a90049 SHA-256: 292d3ec7ae0b09b6d8bfb54b49b89d8120d195042f60394ec9fe528056c2b3a6
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, constituting a link farm. This is indicative of a SEO poisoning or spamming campaign designed to drive traffic to specific content. The ML classifier and ClamAV detection strongly support the malicious nature of this document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7073911-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7073911-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5098092093091094/Nothing-s-Certain-but-Death-Conan-Flagg-4-by-M-K-Wren.pdf
    • http://loaminoo.linkpc.net/5098092093091093/Oh-Bury-Me-Not-Conan-Flagg-3-by-M-K-Wren.pdf
    • http://loaminoo.linkpc.net/5098092093090096/King-of-the-Mountain-Conan-Flagg-8-by-M-K-Wren.pdf
    • http://loaminoo.linkpc.net/5098092095093098/Flagg-s-Small-Houses-Their-Economic-Design-and-Construction-1922-by-Ernest-Flagg.pdf
    • http://loaminoo.linkpc.net/2097098094097095/Wren-s-Quest-Wren-2-by-Sherwood-Smith.pdf
    • http://loaminoo.linkpc.net/8090099095091091/Serial-Manga-Digimon-Detektif-Conan-Doraemon-K-On-Naruto-Bleach-the-Law-of-Ueki-Yes-Precure-5-Death-Note-Shugo-Chara-Hellsing-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/8092093094098091/Conan-Argos-amp-Zingara-Conan-Series-by-Vincent-Darlage.pdf
    • http://loaminoo.linkpc.net/4092093095090/The-Conquering-Sword-of-Conan-Conan-the-Cimmerian-3-by-Robert-E-Howard.pdf
    • http://loaminoo.linkpc.net/7090094096096093/Conan-the-Triumphant-Conan-4-by-Robert-Jordan.pdf
    • http://loaminoo.linkpc.net/6094091099094/Conan-the-Adventurer-Conan-5-by-Robert-E-Howard.pdf
    • http://loaminoo.linkpc.net/4093092094093/Conan-of-Cimmeria-Conan-2-by-Robert-E-Howard.pdf
    • http://loaminoo.linkpc.net/3097094090091097/Conan-the-Wanderer-Conan-4-by-Robert-E-Howard.pdf
    • http://loaminoo.linkpc.net/4098096097096095/Conan-of-Cimmeria-Conan-2-by-Robert-E-Howard.pdf
    • http://loaminoo.linkpc.net/4091090092091094/The-Further-Chronicles-of-Conan-Conan-4-5-7-by-Robert-Jordan.pdf
    • http://loaminoo.linkpc.net/4090096094099096/Conan-the-Buccaneer-Conan-6-by-Lin-Carter.pdf
    • http://loaminoo.linkpc.net/1098095096098090/The-Conan-Chronicles-Volume-2-The-Hour-of-the-Dragon-The-Conan-Chronicles-2-by-Robert-E-Howard.pdf
    • http://loaminoo.linkpc.net/9096097099094092/Arthur-Conan-Doyle-Sherlock-Holmes---Die-Romane-Eine-Studie-in-Scharlachrot---Das-Zeichen-der-Vier---Der-Hund-der-Baskervilles---Das-Tal-des-Grauens-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/3096093092097/The-Coming-of-Conan-the-Cimmerian-Conan-the-Cimmerian-1-by-Robert-E-Howard.pdf
    • http://loaminoo.linkpc.net/3095095099093095/I-Still-Dream-about-You-by-Fannie-Flagg.pdf
    • http://loaminoo.linkpc.net/5098092094094090/FantasyCraft-by-Alex-Flagg.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.