Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e696df8803cc46b…

MALICIOUS

PDF

14.7 KB Created: 2019-05-05 15:56:24 +01:00 Authoring application: mPDF 5.7
MD5: eed96ee00b7f1b105ae04277a2f80949 SHA-1: 3ed217b3453ae2e5fb6ecbe746dd051ce48db4dc SHA-256: 2e696df8803cc46b0e4f9faef76cacc54f8fcccbbfc2c7bc54000bf5bce7ab2a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. While the ML classifier also flagged it as malicious, the specific intent beyond link farming is unclear due to the lack of executable scripts or user-readable content. The URLs themselves appear to be benign, suggesting the primary purpose might be SEO manipulation or a precursor to a more complex attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3094095091099099/Defiant-Ell-Donsaii-9-by-Laurence-E-Dahners.pdf
    • http://loaminoo.linkpc.net/4093094099090099/Comet-Ell-Donsaii-5-by-Laurence-E-Dahners.pdf
    • http://loaminoo.linkpc.net/3094096096096091/Rescue-Ell-Donsaii-11-by-Laurence-E-Dahners.pdf
    • http://loaminoo.linkpc.net/3094095091099093/Lieutenant-Ell-Donsaii-3-by-Laurence-E-Dahners.pdf
    • http://loaminoo.linkpc.net/6095090099090092/Invaders-Vaz-Gettnor-4-by-Laurence-E-Dahners.pdf
    • http://loaminoo.linkpc.net/1090095093093091095/The-Classic-Works-of-Laurence-Oliphant-by-Laurence-Oliphant.pdf
    • http://loaminoo.linkpc.net/1090095093091096095/Laurence-Oliphant-Memoir-of-the-life-of-Laurence-Oliphant-and-of-Alice-Oliphant-his-wife-by-Mrs-Oliphant.pdf
    • http://loaminoo.linkpc.net/1092092090096090/Defiant-Surrender-by-Tamara-Gill.pdf
    • http://loaminoo.linkpc.net/4096092095093097/The-Defiant-The-Valiant-2-by-Lesley-Livingston.pdf
    • http://loaminoo.linkpc.net/2096098092094096/The-Defiant-Bride-by-Leslie-Hachtel.pdf
    • http://loaminoo.linkpc.net/3099097095094093/The-Defiant-Lady-by-Samantha-Garman.pdf
    • http://loaminoo.linkpc.net/7093093099/The-Defiant-The-Valiant-2-by-Lesley-Livingston.pdf
    • http://loaminoo.linkpc.net/2091090097090/Defiant-The-Law-Man-Trilogy-3-by-Millie-Criswell.pdf
    • http://loaminoo.linkpc.net/4094094097099096/The-Defiant-Agents-by-Andre-Norton.pdf
    • http://loaminoo.linkpc.net/1091095096096097097/The-Spaniard-s-Defiant-Virgin-by-Keiko-Okamoto.pdf
    • http://loaminoo.linkpc.net/4091094099099097/Know-Me-Defiant-Motorcycle-Club-1-by-Cora-Brent.pdf
    • http://loaminoo.linkpc.net/4092094094090095/Defiant-Lightship-Chronicles-3-by-Dave-Bara.pdf
    • http://loaminoo.linkpc.net/4099092098096097/Claiming-His-Defiant-Miss-by-Bronwyn-Scott.pdf
    • http://loaminoo.linkpc.net/6097099094/Defiant-Queen-Mount-Trilogy-2-by-Meghan-March.pdf
    • http://loaminoo.linkpc.net/2096092097095096/Viper-s-Defiant-Mate-Sarafin-Warriors-2-by-S-E-Smith.pdf
    • http://loaminoo.linkpc.net/2096098092094096/The-Defiant-Bride-b

Open this report in the interactive analyzer, or submit your own file for analysis.