Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dd2c01c5972907e…

MALICIOUS

PDF

17.0 KB Created: 2019-04-30 02:29:37 +01:00 Authoring application: mPDF 5.7
MD5: c32eff6169594e47310c3a80c19c2f79 SHA-1: e941d66a1a9b9cc33237693b9c22fe8fc13f4656 SHA-256: 2dd2c01c5972907e54766fede6e664c9f8cbe32433b91781712750d7fc435bab
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external websites, as indicated by the PDF_SEO_LINK_FARM heuristic. While many of these URLs were classified as benign, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to redirect users to malicious content. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090099097091096099/Auto-Cad-The-Professional-Reference-by-Kurt-Hampe.pdf
    • http://loaminoo.linkpc.net/4096095097094096/Professional-Identity-Crisis-Race-Class-Gender-and-Success-at-Professional-Schools-by-Carrie-Yang-Costello.pdf
    • http://loaminoo.linkpc.net/1090099097091090099/Tu-Seras-mon-Imp-ratrice-by-Eden-Hampe.pdf
    • http://loaminoo.linkpc.net/1090099097090095099/The-Birth-of-Greek-Art-from-the-Mycenaean-to-the-Archaic-Period-by-Roland-Hampe.pdf
    • http://loaminoo.linkpc.net/1090099097092090097/Sowohl-in-guten-als-auch-in-schlechten-Zeiten-by-Ilse-Hampe.pdf
    • http://loaminoo.linkpc.net/1090099097090097091/50-Jahre-Soziale-Mark-t-Wirtschaft-Eine-Erfolgsstory-Vor-Dem-Ende-by-Peter-Hampe.pdf
    • http://loaminoo.linkpc.net/1090099097091090098/Enumeratio-muscorum-hactenus-in-provinciis-Brasiliensibus-Rio-de-Janeiro-et-S-Paulo-detectorum-by-Ernestus-Hampe.pdf
    • http://loaminoo.linkpc.net/9092096099099095/Kurt-Schwitters-Catalogue-Raisonne-Volume-3-1937-1948-by-Kurt-Schwitters.pdf
    • http://loaminoo.linkpc.net/9092098094090096/Building-the-Monkey-House-At-Kurt-Vonnegut-s-Writing-Table-by-Kurt-Vonnegut.pdf
    • http://loaminoo.linkpc.net/9092097090094090/Kurt-Schwitters-Catalogue-Raisonn-Vol-2-1923-1936-by-Kurt-Schwitters.pdf
    • http://loaminoo.linkpc.net/9092096099098094/Kurt-Schwitters-Merz-A-Total-Vision-Of-The-World-by-Kurt-Schwitters.pdf
    • http://loaminoo.linkpc.net/1096095092094095/The-Little-Auto-by-Guillaume-Apollinaire.pdf
    • http://loaminoo.linkpc.net/1090099091095093097/O-Auto-da-Barca-do-Inferno-HQ-by-Gil-Vicente.pdf
    • http://loaminoo.linkpc.net/1091096095090095098/The-Auto-Book-by-William-H-Crouse.pdf
    • http://loaminoo.linkpc.net/7090093094095095/The-Speedwell-Boys-and-Their-Racing-Auto-by-Roy-Rockwood.pdf
    • http://loaminoo.linkpc.net/8090091095092090/Auto-da-fe-cronache-in-due-tempi-by-Eugenio-Montale.pdf
    • http://loaminoo.linkpc.net/1090099096097099095/Mude-a-Sua-Vida-Com-a-Auto-Hipnose-by-Miguel-Cocco.pdf
    • http://loaminoo.linkpc.net/1090091090099092095/O-Grande-Livro-da-Auto-Atrapalha-o-by-Casmurro-Sobrinho.pdf
    • http://loaminoo.linkpc.net/1091092093098098095/Der-Tag-an-dem-ich-Papa-im-Auto-verga-Roman-by-Antonia-H-Jacob.pdf
    • http://loaminoo.linkpc.net/8097096096096091/Punching-Out-One-Year-in-a-Closing-Auto-Plant-by-Paul-Clemens.pdf
    • http://loaminoo.linkpc.net/1090099097091090098/

Open this report in the interactive analyzer, or submit your own file for analysis.