Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d8083975518f806…

MALICIOUS

PDF

15.8 KB Created: 2019-05-02 01:15:43 +01:00 Authoring application: mPDF 5.7
MD5: 9c7d5187068d2d92b773cb709c392c6d SHA-1: 5f20deea393be679c6afa1ffacbd0caf45767570 SHA-256: 2d8083975518f806c6c4f061fd7db1d1ddd86c747b603484963f3b5a7acf91c9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external websites, identified by the PDF_SEO_LINK_FARM heuristic. While the specific URLs appear benign, the sheer volume and the nature of the heuristic suggest a potential SEO manipulation or a link farm designed to direct users to potentially malicious content. The ML_NYX_PDF_MALICIOUS classifier also flagged this file with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2094091090099092/Silk-Volume-1-Sinister-by-Robbie-Thompson.pdf
    • http://loaminoo.linkpc.net/8091091090091094/Silk-Volume-3-The-Clone-Conspiracy-by-Robbie-Thompson.pdf
    • http://loaminoo.linkpc.net/2093091096/Silk-Volume-0-The-Life-and-Times-of-Cindy-Moon-by-Robbie-Thompson.pdf
    • http://loaminoo.linkpc.net/1099093090099099/Silk-2015-1-by-Robbie-Thompson.pdf
    • http://loaminoo.linkpc.net/2099090097098093/Spider-Man-The-Secret-of-the-Sinister-Six-Sinister-Six-3-by-Adam-Troy-Castro.pdf
    • http://loaminoo.linkpc.net/2091090099096098/The-Writings-of-David-Thompson-Volume-1-The-Travels-1850-Version-by-David-Thompson.pdf
    • http://loaminoo.linkpc.net/7094099090095097/The-Art-of-Painting-on-Silk-Volume-4-Pot-Pourri-by-Pam-Dawson.pdf
    • http://loaminoo.linkpc.net/7090093093098098/Robbie-Shepherd-s-Doric-Columns-by-Robbie-Shepherd.pdf
    • http://loaminoo.linkpc.net/3090091090091097/Silver-Silk-Ties-The-House-On-Silk-Street-1-by-Raven-McAllan.pdf
    • http://loaminoo.linkpc.net/1091091099092095/Daughter-of-Silk-The-Silk-House-1-by-Linda-Lee-Chaikin.pdf
    • http://loaminoo.linkpc.net/2093094099092091/Threads-of-Silk-The-Silk-House-3-by-Linda-Lee-Chaikin.pdf
    • http://loaminoo.linkpc.net/7092090094095098/One-Child-Banners-of-Silk-The-Gentle-Jungle-Reflex-Reader-s-Digest-Condensed-Books-1981-Volume-2-134-by-Torey-L-Hayden.pdf
    • http://loaminoo.linkpc.net/9093099090099/World-War-II-London-Blitz-Diary-Volume-1-by-Ruby-Side-Thompson.pdf
    • http://loaminoo.linkpc.net/2094095093099093/Patricia-Briggs-Mercy-Thompson-Moon-Called-Volume-1-by-David-Lawrence.pdf
    • http://loaminoo.linkpc.net/1090097099097093094/The-Lost-King-of-Oz-Oz-Thompson-and-others-19-by-Ruth-Plumly-Thompson.pdf
    • http://loaminoo.linkpc.net/1090099091099099095/The-Bride-Wore-Red-by-Robbie-C-Sethi.pdf
    • http://loaminoo.linkpc.net/9095090098099098/Alter-Ego-Avatars-and-Their-Creators-by-Robbie-Cooper.pdf
    • http://loaminoo.linkpc.net/1099090097092096/Some-like-It-Sinful-A-Perfect-Recipe-2-by-Robbie-Terman.pdf
    • http://loaminoo.linkpc.net/9096091090092091/Taming-Karla-The-Harper-Twins-2-by-Robbie-Cox.pdf
    • http://loaminoo.linkpc.net/6098096099090098/Nikolai-Dante-Sword-of-the-Tsar-by-Robbie-Morrison.pdf
    • http://loaminoo.linkpc.net/709209

Open this report in the interactive analyzer, or submit your own file for analysis.