Malicious PDF — malware analysis report

Static analysis result for SHA-256 34cac25ddf4cf7e1…

MALICIOUS

PDF

19.9 KB Created: 2019-05-01 19:07:04 +01:00 Authoring application: mPDF 5.7
MD5: 386da9f35018c888b5745eea86e68ea5 SHA-1: 20250a97fe52823cfad2dadc377cc697c1e6e2c8 SHA-256: 34cac25ddf4cf7e1381c13b4f38146dafc08f88d7a3f5c5beb692348e68a349f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While the specific content of the linked PDFs are benign, the sheer volume and structure suggest a malicious intent, likely for SEO manipulation or to distribute further malicious content. The ML_NYX_PDF_MALICIOUS heuristic also flagged this file with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5092093096093097/Mein-Kampf-Illustrated-English-Translation-Edition-Adolf-Hitler-World-War-2-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/7094098096091091/MEIN-KAMPF-quot-Stalag-Edition-quot-BY-ADOLF-HITLER-PUBLISHED-BY-THE-GERMANS-DURING-WW2-FOR-THE-INVASION-OF-BRITAIN-IN-1940-THE-ONLY-ENGLISH-MEIN-KAMPF-EVER-AUTHORIZED-BY-THE-GERMAN-NATIONAL-SOCIALISTS-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/2097094097095096/Mein-Kampf-The-New-Ford-Translation-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/8096091098097093/Mein-Kampf-Plus-In-English-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/6099099090093097/Mein-Kampf-Vol-1-A-Retrospect-Vol-2-The-National-Socialist-Movement-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/6095098095091099/Mein-Kampf-zwei-B-nde-in-einem-Band-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/9097095092095093/Mein-Kampf---My-Struggle-Unabridged-edition-of-Hitlers-original-book---Four-and-a-Half-Years-of-Struggle-against-Lies-Stupidity-and-Cowardice-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/5092095094092099/Mein-Kampf-Mon-combat-AddiQ-Histoire-Mein-Kampf-Mon-combat-t-1-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/9092098093091097/The-Political-Testament-Of-Adolf-Hitler-Recorded-By-Martin-Bormann-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/9092098093097095/Hitler-s-Letters-and-Notes-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/9092098092093097/The-Artist-Formerly-Known-as-Adolf-Hitler-by-A-M-Overett.pdf
    • http://loaminoo.linkpc.net/1093097098097095/Adolf-Hitler-by-John-Toland.pdf
    • http://loaminoo.linkpc.net/9092098092094093/Adolf-Hitler-by-Sean-Stewart-Price.pdf
    • http://loaminoo.linkpc.net/9093090097091093/Mein-Kampf---Adolph-Hitler-by-Richard-Mannheim.pdf
    • http://loaminoo.linkpc.net/9092098092094095/A-Concise-Biography-of-Adolf-Hitler-by-Thomas-Fuchs.pdf
    • http://loaminoo.linkpc.net/4090098098094095/Adolf-Hitler-My-Part-in-his-Downfall-by-Spike-Milligan.pdf
    • http://loaminoo.linkpc.net/9092098092095093/The-Secret-Journals-of-Adolf-Hitler-Volume-1-The-Anointed-by-A-G-Mogan.pdf
    • http://loaminoo.linkpc.net/3099091094099/Adolf-Hitler-My-Part-in-His-Downfall-War-Memoirs-1-by-Spike-Milligan.pdf
    • http://loaminoo.linkpc.net/9092098091099092/Grey-Wolf-The-Escape-of-Adolf-Hitler-by-Simon-Dunstan.pdf
    • http://loaminoo.linkpc.net/7093090099090096/EL-JOVEN-HITLER-1-El-peque-o-Adolf-y-los-demonios-de-la-mente-by-Javier-Cosnava.pdf