Malicious PDF — malware analysis report

Static analysis result for SHA-256 35c99a931f0de8be…

MALICIOUS

PDF

15.3 KB Created: 2019-04-30 03:34:37 +01:00 Authoring application: mPDF 5.7
MD5: 11c648854c08d97f7efe08edb848bd1d SHA-1: c26d6c5c959cc12959abc171ebcfe70940440d1e SHA-256: 35c99a931f0de8be6476bcfa19c43bf0f8a2b8b65e9efd94af6e69e7bce4e919
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm. The primary heuristic, PDF_SEO_LINK_FARM, indicates a malicious intent to direct users to external content. While the specific content of the linked PDFs is benign, the technique of using a PDF as a vehicle for a link farm is suspicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/8206201209205/Ava-and-Zeke-s-New-Home-Amish-Forever-A-New-Journey-1-by-Crystal-Linn.pdf
    • http://xiixmcuin.linkpc.net/8206200200203/Zeke-s-Past-Returns-Amish-Forever-A-New-Journey-5-by-Crystal-Linn.pdf
    • http://xiixmcuin.linkpc.net/8206207208201/Trouble-with-Puppy-Mills-Amish-Forever-A-New-Journey-4-by-Crystal-Linn.pdf
    • http://xiixmcuin.linkpc.net/8206204200202/Clara-s-Christmas-Journey-by-Crystal-Linn.pdf
    • http://xiixmcuin.linkpc.net/8207208209207/Ava-s-Surprise-Amish-Forever-New-Journey-9-by-Roger-Rheinheimer.pdf
    • http://xiixmcuin.linkpc.net/8200209203201/Amish-Forever-A-New-Journey---Volume-10---Happiness-for-All-by-Roger-Rheinheimer.pdf
    • http://xiixmcuin.linkpc.net/8207208206209205/Love-s-Journey-Home-The-Bliss-Creek-Amish-3-by-Kelly-Irvin.pdf
    • http://xiixmcuin.linkpc.net/9204207206207/Coming-Home-Set-Free-An-Amish-Journey-1-by-George-Michael-Loughmueller.pdf
    • http://xiixmcuin.linkpc.net/3202205201200204/That-None-May-Be-Lost-Mark-Miller-s-One-15-by-Crystal-Linn.pdf
    • http://xiixmcuin.linkpc.net/2204207207201208/Ceri-s-journey-Angels-by-Linn-B-Halton.pdf
    • http://xiixmcuin.linkpc.net/6207206200205202/The-Reminiscences-Of-Zeke-Pereira-Dominique-Quinajou-And-Richard-Yokoyama-by-Zeke-Pereira.pdf
    • http://xiixmcuin.linkpc.net/7204203202206/Forever-Amish-by-Kate-Lloyd.pdf
    • http://xiixmcuin.linkpc.net/2207203208208209/Write-Me-Home-Home-In-You-1-by-Crystal-Walton.pdf
    • http://xiixmcuin.linkpc.net/8202203208203/Where-Has-Love-Gone-Amish-Forever-7-by-Roger-Rheinheimer.pdf
    • http://xiixmcuin.linkpc.net/8204209209200/A-Plain-Christmas-Amish-Forever-3-by-Roger-Rheinheimer.pdf
    • http://xiixmcuin.linkpc.net/8204207202209/Bonnets-And-Puppies-Amish-Forever-5-by-Roger-Rheinheimer.pdf
    • http://xiixmcuin.linkpc.net/8204204205201/Rachael-s-Story-Amish-Forever-6-by-Roger-Rheinheimer.pdf
    • http://xiixmcuin.linkpc.net/3206204202208205/A-Way-Home-Gay-Amish-Romance-3-by-Keira-Andrews.pdf
    • http://xiixmcuin.linkpc.net/1205202205209201/An-Amish-Home-by-George-Michael-Loughmueller.pdf
    • http://xiixmcuin.linkpc.net/1208202204201202/A-Way-Home-Gay-Amish-Romance-3-by-Keira-Andrews.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.