Malicious PDF — malware analysis report

Static analysis result for SHA-256 29b0f96a742d7d2c…

MALICIOUS

PDF

16.5 KB Created: 2019-05-03 14:34:59 +01:00 Authoring application: mPDF 5.7
MD5: addeed1aefc1e98d1d655be3fa679ca3 SHA-1: 275ea758617dcc4b0ba3f4c8b3de6be0806103ca SHA-256: 29b0f96a742d7d2c0db2eb2234719d71555533c61c1274baeab6da8b6afe30f2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO poisoning or to distribute further malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. The document body, though heavily obfuscated, contains these URLs, suggesting the primary purpose is to redirect the user to these external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4098094099094093/Bad-Boy-Inspector-Banks-19-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/8098092098098/When-the-Music-s-Over-Inspector-Banks-23-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/5090094095096097/Children-of-the-Revolution-Inspector-Banks-21-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/2095091095092092/In-the-Dark-Places-Inspector-Banks-22-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/2096098092090093/Watching-the-Dark-Inspector-Banks-20-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/8093095092091/Strange-Affair-Inspector-Banks-15-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/4098094094090098/A-Necessary-End-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/9099095096096096/An-inspector-stalls-by-Peter-Aveyard.pdf
    • http://loaminoo.linkpc.net/1092094099090093/The-False-Inspector-Dew-by-Peter-Lovesey.pdf
    • http://loaminoo.linkpc.net/9094091090095091/The-Tribunal-by-Peter-B-Robinson.pdf
    • http://loaminoo.linkpc.net/3093096095091094/Caedmon-s-Song-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/7096097098096/Caedmon-s-Song-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/2093096090095091/Caedmons-Song-by-Peter-Robinson.pdf
    • http://loaminoo.linkpc.net/3096090098091099/The-Inspector-and-Silence-Inspector-Van-Veeteren-5-by-H-kan-Nesser.pdf
    • http://loaminoo.linkpc.net/6091094090097098/A-Trilogy-of-Island-Adventures-Robinson-Crusoe-The-Swiss-Family-Robinson-Treasure-Island-by-Daniel-Defoe.pdf
    • http://loaminoo.linkpc.net/3090096092093096/Inspector-Anders-and-the-Blood-Vendetta-Inspector-Anders-3-by-Marshall-Browne.pdf
    • http://loaminoo.linkpc.net/5093099091095097/Robinson-Crusoe-En-espa-ol-Vida-y-extraordinarias-y-portentosas-aventuras-de-Robinson-Crusoe-de-York-navegante-con-24-ilustraciones-pr-logo-notas-y-bigrafia-by-Daniel-Defoe.pdf
    • http://loaminoo.linkpc.net/1091093093090099/The-Wooden-Leg-of-Inspector-Anders-Inspector-Anders-1-by-Marshall-Browne.pdf
    • http://loaminoo.linkpc.net/4098095092099099/Inspector-Ghote-Hunts-the-Peacock-Inspector-Ghote-4-by-H-R-F-Keating.pdf
    • http://loaminoo.linkpc.net/3090093091090092/Detective-Inspector-Huss-Inspector-Huss-1-by-Helene-Tursten.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.