Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ae64badb5c572c7…

MALICIOUS

PDF

21.8 KB Created: 2019-04-30 05:59:42 +01:00 Authoring application: mPDF 5.7
MD5: b5958edbc2e40927874c6382fa792ab0 SHA-1: 6b9e2570ca4cfa41bd6a37bcb9a7bc3ca4d0430c SHA-256: 4ae64badb5c572c7135a0dca50efee1daf4061059c74f1a4b25be15ca5f5ed16
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, primarily hosted on loaminoo.linkpc.net. This heuristic firing suggests a link farm or redirection tactic. The ML classifier also flagged the document as malicious with high confidence. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9903

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3097090098095090/The-Well-Beloved-with-The-Pursuit-of-the-Well-Beloved-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/6092096095096099/UNDER-THE-GREENWOOD-TREE-by-Thomas-Hardy-author-of-Tess-of-the-d-Urbervilles-Far-From-the-Madding-Crowd-Jude-the-Obscure-The-Mayor-of-Casterbridge-The-Well-Beloved-Annotated-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/4097099096099097/The-Well-Beloved-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/2095093099094/Beloved-Stranger-Beloved-Trilogy-2-by-Patricia-Potter.pdf
    • http://loaminoo.linkpc.net/6093096091093092/My-Beloved-The-Story-of-a-Carmelite-Nun-by-Mother-Catherine-Thomas.pdf
    • http://loaminoo.linkpc.net/6093096090098091/My-Beloved-The-Story-of-a-Carmelite-Nun-by-Mother-Catherine-Thomas-of-Divine-Providence.pdf
    • http://loaminoo.linkpc.net/9098095092095097/Tess-of-the-D-urbervilles-by-Thomas-Hardy-Illustrated-Delphi-Parts-Edition-Thomas-Hardy-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/2097092094091093/The-Collected-Novels-of-Thomas-Hardy-vol-1-Far-from-the-Madding-Crowd-The-Return-of-the-Native-The-Mayor-of-Casterbridge-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/7091093093093099/Tess-of-the-d-Urbervilles-By-Thomas-Hardy-Illustrated-amp-Unabridged-Free-Bonus-Audiobook-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/1091098099099093092/Desperate-Remedies-A-Novel-by-Thomas-Hardy-and-By-Sir-W-Scott-Illusreated-By-F-Fred-Barnard-16-May-1846---28-September-1896-Was-a-Victorian-English-Illustrator-Caricaturist-and-Genre-Painter-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/2091093098090098/The-Beloved-by-P-A-Minyard.pdf
    • http://loaminoo.linkpc.net/8098095096094090/Beloved-of-the-Sun-by-Ann-Leckie.pdf
    • http://loaminoo.linkpc.net/9095096096090091/The-Beloved-by-David-Helwig.pdf
    • http://loaminoo.linkpc.net/2095091094090092/My-Beloved-The-Witch-by-T-M-Mendes.pdf
    • http://loaminoo.linkpc.net/3095098094095097/Beloved-by-Toni-Morrison.pdf
    • http://loaminoo.linkpc.net/6091095094092/Israel-My-Beloved-by-Kay-Arthur.pdf
    • http://loaminoo.linkpc.net/4090095095094096/Beloved-Dog-by-Maira-Kalman.pdf
    • http://loaminoo.linkpc.net/1095094093090096/Beloved-by-Toni-Morrison.pdf
    • http://loaminoo.linkpc.net/5090099094092097/Beloved-by-Laine-Cunningham.pdf
    • http://loaminoo.linkpc.net/7097094094091/Come-Away-My-Beloved-by-Frances-J-Roberts.pdf
    • http://loaminoo.linkpc.net/6093096091093092/My-Beloved-The-Story-of-a-Carmelite-Nun-by-Mot

Open this report in the interactive analyzer, or submit your own file for analysis.