Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f6ef66b5bea9d8c…

MALICIOUS

PDF

19.0 KB Created: 2019-04-30 03:45:14 +01:00 Authoring application: mPDF 5.7
MD5: 03c6210be0c4057dc261e35521fdf41c SHA-1: e62020133a0cb6643d208afb5ba493790c996663 SHA-256: 2f6ef66b5bea9d8c4389fc5c2e45c8c65d235b808689cc137f29b0a422d88abf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly indicated maliciousness, and the heuristic identified a link farm. No scripts were extracted from this sample. The primary attack pattern involves directing users to a large number of external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4096091096098092/The-Night-Child-by-Anna-Quinn.pdf
    • http://loaminoo.linkpc.net/2097099094090097/The-Night-Child-by-Anna-Quinn.pdf
    • http://loaminoo.linkpc.net/3099091096093093/Hard-Days-Night-The-Firsts-8-by-C-L-Quinn.pdf
    • http://loaminoo.linkpc.net/1094095094096091/A-Night-Like-This-Smythe-Smith-Quartet-2-by-Julia-Quinn.pdf
    • http://loaminoo.linkpc.net/2091099091095094/Night-Pilgrims-Saint-Germain-26-by-Chelsea-Quinn-Yarbro.pdf
    • http://loaminoo.linkpc.net/4098098097092098/Anatomy-of-a-Night-by-Anna-Kim.pdf
    • http://loaminoo.linkpc.net/2096092090096099/Child-Of-The-Night-V1-by-Scribe-Mozell.pdf
    • http://loaminoo.linkpc.net/1092092099098090/The-Night-Serpent-by-Anna-Leonard.pdf
    • http://loaminoo.linkpc.net/1097095099091096/A-Hundred-Hours-of-Night-by-Anna-Woltz.pdf
    • http://loaminoo.linkpc.net/1095096093098096/Child-of-Night-and-Day-Champion-of-the-Gods-4-by-Andrew-Q-Gordon.pdf
    • http://loaminoo.linkpc.net/1097093091096099/Night-Games-Sex-Power-and-Sport-by-Anna-Krien.pdf
    • http://loaminoo.linkpc.net/9091096091094/All-Night-All-Day-A-Child-s-First-Book-of-African-American-Spirituals-by-Ashley-Bryan.pdf
    • http://loaminoo.linkpc.net/1098096096096098/Quinn-Eve-Quinn-and-Bonnie-2-by-Iris-Johansen.pdf
    • http://loaminoo.linkpc.net/3092092091091092/Mind-Your-Own-Business-Survive-and-Thrive-in-Good-Times-and-Bad-by-Feargal-Quinn-by-Feargal-Quinn.pdf
    • http://loaminoo.linkpc.net/3099099098099093/Good-Night-Sleep-Tight-The-Sleep-Lady-s-Gentle-Guide-to-Helping-Your-Child-Go-to-Sleep-Stay-Asleep-and-Wake-Up-Happy-by-Kim-West.pdf
    • http://loaminoo.linkpc.net/3099099098097091/Roots-of-Empathy-Changing-the-World-Child-by-Child-by-Mary-Gordon.pdf
    • http://loaminoo.linkpc.net/3095096099099095/When-your-Child-is-6-to-12-Middle-Childhood-Is-The-Last-Good-Chance-To-Hold-Your-Child-Close-by-John-M-Drescher.pdf
    • http://loaminoo.linkpc.net/9097091091093093/The-Child-and-the-State-in-India-Child-Labor-and-Education-Policy-in-Comparative-Perspective-by-Myron-Weiner.pdf
    • http://loaminoo.linkpc.net/1091091092092090099/Grieving-the-Child-I-Never-Knew-A-Devotional-for-Comfort-in-the-Loss-of-Your-Unborn-or-Newly-Born-Child-by-Kathe-Wunnenberg.pdf
    • http://loaminoo.linkpc.net/1098097094092090/Night-Shield-amp-Night-Moves-Night-Tales-5-amp-6-by-Nora-Roberts.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.