Malicious PDF — malware analysis report

Static analysis result for SHA-256 45188f4783110797…

MALICIOUS

PDF

20.5 KB Created: 2019-04-29 23:22:25 +01:00 Authoring application: mPDF 5.7 First seen: 2019-09-30
MD5: c4ad009aea8da1a8d39f9a79c495e34d SHA-1: d62b7da0681726cf9e6b78d9ee27ace43030e59b SHA-256: 45188f4783110797e890f5039511801040b9a5f05d8758d87dda30f9e8e1046a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While many of these URLs point to benign content, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to distribute further malware. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5099095095092090/Compositions-by-Claude-Debussy-Operas-by-Claude-Debussy-Preludes-by-Claude-Debussy-Pelleas-Et-Melisande-by-Source-Wikipedia.pdf In PDF document text
    • http://loaminoo.linkpc.net/5099095095092091/OPD-7047-Debussy-Pell-as-and-M-lisande-French-English-Libretto-by-Claude-Debussy.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6091093091099098/Valse-romantique-by-Claude-Debussy.pdfIn PDF document text
    • http://loaminoo.linkpc.net/5099095093099092/Claude-Debussy-Pell-as-et-M-lisande-by-Roger-Nichols.pdfIn PDF document text
    • http://loaminoo.linkpc.net/5099095094095099/Pelleas-and-Melisande-Lyric-Drama-in-Five-Acts-by-Claude-Debussy.pdfIn PDF document text
    • http://loaminoo.linkpc.net/8091095096095098/Pell-as-and-Melisande-Lyric-Drama-in-Five-Acts-by-Claude-Debussy.pdfIn PDF document text
    • http://loaminoo.linkpc.net/7096098097098093/Reflections-in-the-Water-Hommage-to-Rameau-Mouvement-by-Claude-Debussy.pdfIn PDF document text
    • http://loaminoo.linkpc.net/7094097095097098/Il-pleure-dans-mon-coeur-comme-il-pleut-sur-la-ville---No-2-from-quot-Ariettes-oubli-es-quot---L60-by-Claude-Debussy.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1090091092095090092/The-Political-Economy-Of-Crisis-And-Underdevelopment-In-Africa-Selected-Works-Of-Claude-Ake-by-Claude-Ake.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6095094094093094/Le-Robinson-de-douze-ans-by-Madame-Mall-s-de-Beaulieu.pdfIn PDF document text
    • http://loaminoo.linkpc.net/5093090096094092/Les-douze-travaux-de-Stephanie-by-Janet-Evanovich.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6095094091094095/Pen-in-the-Dark-Narratives-letters-secrets-and-poems-by-Douze.pdfIn PDF document text
    • http://loaminoo.linkpc.net/4090093098093092/The-Lost-Ways-Amazon-Ultimate-Survival-Food-by-Claude-Davis-Scam-by-Claude-Davis.pdfIn PDF document text
    • http://loaminoo.linkpc.net/5097094090096096/Les-Douze-rois-de-Sharakha-The-Song-of-the-Shattered-Sands-1-by-Bradley-P-Beaulieu.pdfIn PDF document text
    • http://loaminoo.linkpc.net/9090097093097099/Metamorphosen-Der-Siebten-Kunst-Franzosische-Romane-Des-19-Jahrhunderts-in-Ihrer-Filmischen-Umsetzung-Flaubert-Madame-Bovary-Claude-Chabrol-1991-Zola-Germinal-Claude-Berri-1993-by-Sabine-Seifert.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3095094091099093/The-Lost-Ways-2-by-Claude-Davis-Best-Survival-Guide-Book-by-Claude-Davis.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6096091098096097/Du-mur-de-Berlin-aux-tours-de-New-York-Douze-ans-pour-changer-de-si-cle-by-Ren-R-mond.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6095094095090094/Tulsa-Times-A-Pictorial-History-The-Boom-Years-Book-2-by-Susan-Everly-Douze.pdfIn PDF document text
    • http://loaminoo.linkpc.net/8094096091097097/Etudes-by-Unknown.pdfIn PDF document text
    • http://loaminoo.linkpc.net/8094096090095095/Eight-tudes-by-Elizabeth-Robinson.pdfIn PDF document text
    • http://loaminoo.linkpc.net/7094097095097098/Il-pleure-dans-mon-coeur-comme-il-pleut-sur-la-ville---No-2-from-quot-Ariettes-oubli-es-quot---L6In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.