Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ff6aa02ad6c9886…

MALICIOUS

PDF

23.2 KB Created: 2019-04-30 23:24:21 +01:00 Authoring application: mPDF 5.7
MD5: 379d2bc31dcac6878388893d160be8fd SHA-1: d241ef6d736fa103a0ceee6aa9767d2751e330c8 SHA-256: 2ff6aa02ad6c98868cddc24981fa4fe046f966650f44e55394d92bb3963627ff
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links, forming a link farm. The primary heuristic indicates this is a PDF SEO link farm, with 28 external PDF links generated. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent to redirect users to potentially harmful content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7095091091093096/Memnon-1re-version-de-Zadig-by-Voltaire.pdf
    • http://loaminoo.linkpc.net/7095091091099090/Voltaire-10-Romane-u-a-Candide-Die-Prinzessin-von-Babylon-Mikromegas-Skarmentados-Reisen-Der-Wei-e-und-der-Schwarze-Wie-s-in-der-Welt-geht-Jeannot-Colin-Der-Hurone-Zadig-by-Voltaire.pdf
    • http://loaminoo.linkpc.net/7095091091099093/Works-of-Voltaire-20-works-Candide-Zadig-Philosophical-Dictionary-selected-poetry-amp-more-by-Voltaire.pdf
    • http://loaminoo.linkpc.net/7095091090099094/The-Symbolism-of-Voltaire-s-Novels-With-Special-References-to-Zadig-by-William-Raleigh-Price.pdf
    • http://loaminoo.linkpc.net/7095091090099099/The-Symbolism-of-Voltaire-s-Novels-with-Special-Reference-to-Zadig-by-William-Raleigh-Price.pdf
    • http://loaminoo.linkpc.net/7095091091092098/The-Symbolism-of-Voltaire-s-Novels-with-Special-Reference-to-Zadig-Pp-1-257-by-William-Raleigh-Price.pdf
    • http://loaminoo.linkpc.net/7095091090099096/The-Symbolism-of-Voltaire-s-Novels-with-Special-References-to-Zadig-by-William-Raleigh-1875--Price.pdf
    • http://loaminoo.linkpc.net/6091099095094094/Oh-My-Goth-Version-2-0-by-Aurelio-Voltaire.pdf
    • http://loaminoo.linkpc.net/6091099095098097/Memoirs-of-the-Life-of-Monsieur-de-Voltaire-by-Voltaire.pdf
    • http://loaminoo.linkpc.net/7092091096092098/Pride-and-Prejudice---Original-Illustration-Version---Full-Translated-Version-by-Jane-Austen.pdf
    • http://loaminoo.linkpc.net/6092097093098092/The-Picture-of-Dorian-Gray-Collector-s-Edition-Including-the-Uncensored-13-Chapter-Version-amp-The-Revised-20-Chapter-Version-by-Oscar-Wilde.pdf
    • http://loaminoo.linkpc.net/5096090099093095/Insiders-english-version---volume-1---Chechen-Guerrilla-I-R-english-version-by-Jean-Claude-Bartoll.pdf
    • http://loaminoo.linkpc.net/3093093095095090/Whispers-in-the-Branches-Text-only-version-Text-Only-Version-by-Brandy-Heineman.pdf
    • http://loaminoo.linkpc.net/7095091090092091/On-the-Method-of-Zadig-by-Thomas-Henry-Huxley.pdf
    • http://loaminoo.linkpc.net/7095091090098093/The-Complete-Book-Of-Boat-Electronics-by-Ernest-A-Zadig.pdf
    • http://loaminoo.linkpc.net/7095091090098097/The-Complete-Book-Of-Pleasure-Boat-Engines-by-Ernest-A-Zadig.pdf
    • http://loaminoo.linkpc.net/7095091090098098/Theoretical-and-Observational-Problems-Related-to-Solar-Eclipses-by-Zadig-Mouradian.pdf
    • http://loaminoo.linkpc.net/7095091091098094/Zadig-E-Astartea-Drama-Serio-Em-Dois-Actos-Para-Se-Representar-No-Real-Theatro-de-S-Carlos-by-Nicola-Vaccai.pdf
    • http://loaminoo.linkpc.net/7095091091098091/The-Novelist-s-Magazine-1780-Vol-2-Containing-Solyman-and-Almena-The-Vicar-of-Wakefield-Roderick-Random-Zadig-The-Devil-Upon-Two-Sticks-by-Unknown.pdf
    • http://loaminoo.linkpc.net/4094091098094097/Candide-by-Voltaire.pdf
    • http://loaminoo.linkpc.net/7095091090099099/The-Symbolism-of-Voltaire-s-Novels

Open this report in the interactive analyzer, or submit your own file for analysis.