Malicious PDF — malware analysis report

Static analysis result for SHA-256 340a341558f324c8…

MALICIOUS

PDF

14.9 KB Created: 2019-05-01 17:19:34 +01:00 Authoring application: mPDF 5.7
MD5: 8af4f6ab1d894476be0f6408ad9f2790 SHA-1: f284e180f3631f92f36b06bc3e64289360935a72 SHA-256: 340a341558f324c8487d47c276b38ae802a1c6ec46c9a265418b80cdea2bd949
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, forming a link farm. This is indicative of a SEO poisoning or traffic generation scheme, potentially leading to malicious sites or further compromise. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4097093090092090/100-Poems-from-the-Japanese-by-Kenneth-Rexroth.pdf
    • http://loaminoo.linkpc.net/2098094094092/In-What-Hour-by-Kenneth-Rexroth.pdf
    • http://loaminoo.linkpc.net/4098095099099099/Classics-Revisited-by-Kenneth-Rexroth.pdf
    • http://loaminoo.linkpc.net/5090099099095090/How-the-Bicycle-Shone-New-amp-Selected-Poems-New-and-Selected-Poems-by-Gillian-Allnutt.pdf
    • http://loaminoo.linkpc.net/3094099099095/Thirsting-for-Peace-in-a-Raging-Century-Selected-Poems-1961-85-Selected-Works-2-by-Ed-Sanders.pdf
    • http://loaminoo.linkpc.net/5098097091090092/War-amp-Love-Love-amp-War-New-and-Selected-Poems-New-and-Selected-Poems-by-Aharon-Shabtai.pdf
    • http://loaminoo.linkpc.net/2091098099091/The-Selected-Correspondence-of-Kenneth-Burke-and-Malcolm-Cowley-by-Paul-Jay.pdf
    • http://loaminoo.linkpc.net/1091090092093097099/Iona-Poems-by-Kenneth-Steven.pdf
    • http://loaminoo.linkpc.net/1099090099098096/Complete-Poems-by-Kenneth-Fearing.pdf
    • http://loaminoo.linkpc.net/4098094091098091/The-Collected-Poems-by-Kenneth-Koch.pdf
    • http://loaminoo.linkpc.net/1099096096098099/The-Selected-Poems-of-Tu-Fu-by-Du-Fu.pdf
    • http://loaminoo.linkpc.net/3093094099090096/The-Three-Way-Tavern-Selected-Poems-by-Ko-Un.pdf
    • http://loaminoo.linkpc.net/1099096096099094/The-Selected-Poems-by-Wang-Wei.pdf
    • http://loaminoo.linkpc.net/1090097099092/The-Best-of-It-New-and-Selected-Poems-by-Kay-Ryan.pdf
    • http://loaminoo.linkpc.net/2098099091093096/Selected-Poems-by-W-B-Yeats.pdf
    • http://loaminoo.linkpc.net/1091092091096093090/Selected-Poems-by-D-H-Lawrence.pdf
    • http://loaminoo.linkpc.net/4095099091094093/Selected-Poems-by-Octavio-Paz.pdf
    • http://loaminoo.linkpc.net/9094090097093/Selected-Poems-by-W-H-Auden.pdf
    • http://loaminoo.linkpc.net/4095097096098095/Selected-Poems-by-Robert-Browning.pdf
    • http://loaminoo.linkpc.net/2093093090097091/Selected-Poems-by-John-Betjeman.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.