Malicious PDF — malware analysis report

Static analysis result for SHA-256 41627f5cc2ea338a…

MALICIOUS

PDF

14.7 KB Created: 2019-04-30 04:13:19 +01:00 Authoring application: mPDF 5.7
MD5: d2ecb3f1d658be7b4436351b79d0a8f0 SHA-1: a8516a035d06787733876e2da0dd430a23996f10 SHA-256: 41627f5cc2ea338a0886fa537fc5e779bd6eeb3b8d2704e6b5fc8f987ec21d06
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles, suggesting a potential SEO manipulation or content distribution scheme. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1092095091091093/The-Devil-s-Concubine-The-Devil-of-Ponong-series-1-by-Jill-Braden.pdf
    • http://loaminoo.linkpc.net/3094099091094093/The-Devil-Is-a-Marquess-Rescued-from-Ruin-4-by-Elisa-Braden.pdf
    • http://loaminoo.linkpc.net/3090094092090094/A-Devil-Named-Desire-The-Devil-s-Bargain-2-by-Terri-Garey.pdf
    • http://loaminoo.linkpc.net/5091094092095090/The-Fallen-Devil-The-Great-Devil-War-6-by-Kenneth-B-Andersen.pdf
    • http://loaminoo.linkpc.net/1097096094099097/The-Devil-s-Horizon-Devil-s-Fire-3-by-Matt-Tomerlin.pdf
    • http://loaminoo.linkpc.net/1097096091091097/The-Devil-s-Revenge-The-Devil-s-Eyes-2-by-Jennifer-Loren.pdf
    • http://loaminoo.linkpc.net/4095096091097093/Wanted-By-The-Devil-Devil-s-Riders-1-by-Joanna-Blake.pdf
    • http://loaminoo.linkpc.net/5097092098/Wanted-By-The-Devil-Devil-s-Riders-1-by-Joanna-Blake.pdf
    • http://loaminoo.linkpc.net/3095095099098098/Devil-s-in-the-Details-Devil-s-Book-1-by-Sydney-Gibson.pdf
    • http://loaminoo.linkpc.net/4099097097093093/Before-the-Devil-Knows-You-re-Dead-Speak-of-the-Devil-3-by-Patricia-Eimer.pdf
    • http://loaminoo.linkpc.net/2099091095098095/The-Devil-s-Match-The-Devil-DeVere-4-by-Victoria-Vane.pdf
    • http://loaminoo.linkpc.net/1091092093098091092/Scarlett-The-Devil-s-Daughter-The-Devil-s-Children-2-by-S-J-Crabb.pdf
    • http://loaminoo.linkpc.net/2091097098099090/Luck-of-the-Devil-Speak-of-the-Devil-1-by-Patricia-Eimer.pdf
    • http://loaminoo.linkpc.net/4095093095096094/The-Devil-s-Tide-Devil-s-Fire-2-by-Matt-Tomerlin.pdf
    • http://loaminoo.linkpc.net/4095093096099096/The-Devil-s-Horizon-Devil-s-Fire-3-by-Matt-Tomerlin.pdf
    • http://loaminoo.linkpc.net/3093091091097094/Devil-s-Pact-The-Devil-s-Playground-1-by-Samantha-Cruise.pdf
    • http://loaminoo.linkpc.net/3094093099099099/The-Devil-s-Match-The-Devil-DeVere-4-by-Victoria-Vane.pdf
    • http://loaminoo.linkpc.net/4096091093092095/The-Devil-s-Dreamcatcher-The-Devil-s-2-by-Donna-Hosie.pdf
    • http://loaminoo.linkpc.net/3090097090093092/The-Irish-Devil-Devil-1-by-Diane-Whiteside.pdf
    • http://loaminoo.linkpc.net/1097096090098097/The-Devil-s-Son-The-Devil-s-Eyes-3-by-Jennifer-Loren.pdf
    • http://loaminoo.linkpc.net/2099091095

Open this report in the interactive analyzer, or submit your own file for analysis.