Malicious PDF — malware analysis report

Static analysis result for SHA-256 37d9dfcf7b2e72c7…

MALICIOUS

PDF

15.3 KB Created: 2019-04-30 04:44:55 +01:00 Authoring application: mPDF 5.7
MD5: cf9b369cd7c6e870cfcd010f2c572ba0 SHA-1: a69b3f07ca71855063c9513ab4d02c01853b65e8 SHA-256: 37d9dfcf7b2e72c72c974fa64e47af2a898842a4bf4f9d0b2fa776939eb626a7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently flagged as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to serve as a lure for further malicious activity. No scripts were extracted, and the document body was not parsable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5090090096093096/Miss-Delacourt-Has-Her-Day-by-Heidi-Ashworth.pdf
    • http://loaminoo.linkpc.net/4096099096092098/O-er-The-River-Liffey-by-Heidi-Ashworth.pdf
    • http://loaminoo.linkpc.net/2090090095090097/Miss-Armistead-Makes-Her-Choice-by-Heidi-Ashworth.pdf
    • http://loaminoo.linkpc.net/4098097099098090/Lady-Crenshaw-s-Christmas-Miss-Delacourt-3-by-Heidi-Ashworth.pdf
    • http://loaminoo.linkpc.net/1093092091098098/The-Lord-Who-Sneered-and-Other-Tales-Miss-Delacourt-5-by-Heidi-Ashworth.pdf
    • http://loaminoo.linkpc.net/1093092091098099/Lord-Haversham-Takes-Command-Miss-Delacourt-4-by-Heidi-Ashworth.pdf
    • http://loaminoo.linkpc.net/1099096090091093/Miss-Delacourt-Has-Her-Day-Miss-Delacourt-2-by-Heidi-Ashworth.pdf
    • http://loaminoo.linkpc.net/1091098096094097090/Ball-Four-Plus-Ball-Five-An-Update-1970-1980-by-Jim-Bouton.pdf
    • http://loaminoo.linkpc.net/1090090093098098099/Dragon-Ball-Vol-7-General-Blue-and-the-Pirate-Treasure-Dragon-Ball-7-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/5096097097091099/Dragon-Ball-Vol-8-Taopaipai-and-Master-Karin-Dragon-Ball-8-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/7099093091098/Dragon-Ball-Z-Vol-1-The-World-s-Greatest-Team-Dragon-Ball-Z-1-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/1090090093099094093/Dragon-Ball-Z-Vol-7-The-Ginyu-Force-Dragon-Ball-Z-7-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/4090091097091097/Dragon-Ball-Z-Vol-22-Mark-of-the-Warlock-Dragon-Ball-Z-22-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/1090090093098098096/Dragon-Ball-Vol-4-Strongest-Under-the-Heavens-Dragon-Ball-4-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/1090090093098099093/Dragon-Ball-Z-Vol-4-Goku-vs-Vegeta-Dragon-Ball-Z-4-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/8095095098091094/Dragon-Ball-Vol-15-The-Titanic-Tournament-Dragon-Ball-15-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/1090090094090094094/Dragon-Ball-Z-Vol-9-The-Wrath-of-Freeza-Dragon-Ball-Z-9-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/4090098091095090/Dragon-Ball-Z-Vol-18-Gohan-vs-Cell-Dragon-Ball-Z-18-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/4090091097091094/Dragon-Ball-Z-Vol-24-Hercule-to-the-Rescue-Dragon-Ball-Z-24-by-Akira-Toriyama.pdf
    • http://loaminoo.linkpc.net/4090091097091095/Dragon-Ball-Z-Vol-23-Boo-Unleashed-Dragon-Ball-Z-23-by-Akira-Toriyama.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.