Malicious PDF — malware analysis report

Static analysis result for SHA-256 416c85c54ae906de…

MALICIOUS

PDF

18.9 KB Created: 2019-04-30 04:12:23 +01:00 Authoring application: mPDF 5.7
MD5: 334b4591a88c425300a9be551c0328a6 SHA-1: 5d0a05c13be104f2a56818e98cc77cd0d3cbc315 SHA-256: 416c85c54ae906de939edfc27b1f634d21d7c13b28c62e64423f19bf9854d9f3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a machine learning classifier as malicious. A critical heuristic identified it as a link farm, containing numerous external URLs. The document body, though heavily obfuscated, appears to contain these URLs, suggesting the primary intent is to redirect users to a large number of external sites, likely for malicious purposes such as phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7094098097090091/Articles-on-Novels-by-Frank-Herbert-Including-Children-of-Dune-Chapterhouse-Dune-Dune-Messiah-God-Emperor-of-Dune-Heretics-of-Dune-Dune-Novel-the-Dragon-in-the-Sea-Destination-Void-Whipping-Star-the-Dosadi-Experiment-by-Hephaestus-Books.pdf
    • http://loaminoo.linkpc.net/3096098098090/Chapterhouse-Dune-Dune-Chronicles-6-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/7094098095094099/Dune-Novels-Book-Guide-Dune-Heretics-of-Dune-Children-of-Dune-Chapterhouse-Dune-God-Emperor-of-Dune-Dune-Messiah-Sandworms-of-Dune-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/7094098095095091/Dune-Book-Series-Legends-Of-Dune-Dune-Short-Stories-Heroes-Of-Dune-Prelude-To-Dune-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/7094098095094091/Dune-The-Gateway-Collection-Dune-Chronicles-1-6-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3094091096092098/Children-of-Dune-Dune-Chronicles-3-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3092092099090093/God-Emperor-of-Dune-Dune-Chronicles-4-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3093099091097/God-Emperor-of-Dune-Dune-Chronicles-4-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/4090095099094099/God-Emperor-of-Dune-Dune-Chronicles-4-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3093099098098/Dune-Messiah-Dune-Chronicles-2-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/5092097092099/God-Emperor-of-Dune-Dune-Chronicles-4-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3098091092091095/Children-of-Dune-Dune-Chronicles-3-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/5095090097097090/Dune-Dune-Chronicles-1-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/7090097090098/Dune-Dune-Chronicles-1-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/2092092093091091/Dune-Dune-Chronicles-1-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/1092094096091091/Hunters-Of-Dune-Dune-Chronicles-7-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/8098091094092/Hunters-of-Dune-Dune-Chronicles-7-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/7094098094097090/Dune-Red-Plague-A-Tale-of-the-Schools-of-Dune-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/2096096090096098/The-Winds-Of-Dune-Heroes-of-Dune-2-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/3095096096098092/Paul-Of-Dune-Heroes-of-Dune-1-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/7094098095094091/Dune

Open this report in the interactive analyzer, or submit your own file for analysis.