Malicious PDF — malware analysis report

Static analysis result for SHA-256 47d85912b8d4e7bf…

MALICIOUS

PDF

18.7 KB Created: 2019-05-02 09:02:36 +01:00 Authoring application: mPDF 5.7
MD5: f3bdbd420956b57a4ba330ba80524ca4 SHA-1: 8e73b50606990b365ef3d974f285c5e3a3b0c1a8 SHA-256: 47d85912b8d4e7bf005c6f389029a1bd0d93b79386f746cd52c85219730fbcaf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, masquerading as free e-books. This technique is often used to drive traffic to malicious sites or to distribute further malware. The ML classifier strongly supports the malicious verdict, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5096090096099092/Hamlet-FREE-The-Tragedy-Of-Macbeth-By-William-Shakespeare-100-Formatted-Illustrated---JBS-Classics-100-Greatest-Novels-of-All-Time-Book-23-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/1090098099094098091/Complete-Works-of-William-Shakespeare-154-Sonnets-Romeo-and-Juliet-Othello-Hamlet-Macbeth-Antony-and-Cleopatra-The-Tempest-Julius-Caesar-King-Cressida-The-Winter-s-Tale-amp-more-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5095098094093093/Hamlet-Prince-of-Denmark-The-Plays-of-William-Shakespeare-Vol-17-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/7091091095098098/Hamlet-Shakespeare-Appreciated-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5092099099092093/Hamlet-Shakespeare-Appreciated-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/7092093091091092/Shakespeare-s-Hamlet-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/6090092093090092/Hamlet---The-First-Quarto-Sos-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5096097099091092/Hamlet-Prince-of-Denmark-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/4098096098091/Hamlet-Prince-of-Denmark-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/1090094098098092091/Hamlet-Prince-of-Denmark-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/1090090097091094094/Hamlet-Englisch-Deutsch-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5096097096098094/Hamlet-Prince-of-Denmark-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/6092091098090097/Hamlet-Prince-of-Denmark-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5097096098099095/Hamlet-The-Texts-of-1603-and-1623-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5095098092098/Hamlet-Norton-Critical-Edition-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/1090094091097097098/Hamlet-Enriched-eBook-Classic-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5097094091090093/Hamlet-The-Original-Play-with-a-Modern-Translation-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5096090097094091/Three-Tragedies-Romeo-and-Juliet-Hamlet-Macbeth-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/6090093090091096/Hamlet-Reclams-Rote-Reihe---Fremdsprachentexte-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/6090096098091099/-quot-Hamlet-quot-William-Shakespeare-by-William-Shakespeare.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.