Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ae7fed430b314db…

MALICIOUS

PDF

14.6 KB Created: 2019-05-02 00:47:39 +01:00 Authoring application: mPDF 5.7
MD5: dc79e57b5458d145d2a881f97bf7c06e SHA-1: 7236d6aba517a2ceb62524e88d6b4043f4cf9d4a SHA-256: 4ae7fed430b314db12b6c5813d80190f6cffb15991707df1efd74c19643ff6f9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious with high confidence. The embedded links, such as http://loaminoo.linkpc.net/4098091091095094/Demon-Hunting-With-a-Dixie-Deb-Demon-Hunting-4-by-Lexi-George.pdf, likely serve to distribute further malicious content or engage in SEO spam. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4098091091095094/Demon-Hunting-With-a-Dixie-Deb-Demon-Hunting-4-by-Lexi-George.pdf
    • http://loaminoo.linkpc.net/2098099094094097/Demon-Hunting-in-Dixie-Demon-Hunting-1-by-Lexi-George.pdf
    • http://loaminoo.linkpc.net/2098092090096099/Demon-Hunting-in-Dixie-Demon-Hunting-1-by-Lexi-George.pdf
    • http://loaminoo.linkpc.net/3094096090097097/Harlem-by-Len-Riley.pdf
    • http://loaminoo.linkpc.net/1093092093096098/The-Harlem-Hellfighters-by-Max-Brooks.pdf
    • http://loaminoo.linkpc.net/5095096091099/Harlem-Duet-by-Djanet-Sears.pdf
    • http://loaminoo.linkpc.net/7096099092094099/Harlem-to-Holsteins-by-L-Kenneth-Haynes.pdf
    • http://loaminoo.linkpc.net/1099090097093096/High-Sticked-Hot-Ice-5-by-Lily-Harlem.pdf
    • http://loaminoo.linkpc.net/4095091098095097/Harlem-Hustle-by-Janet-McDonald.pdf
    • http://loaminoo.linkpc.net/2099092093095096/Cotton-Comes-To-Harlem-by-Chester-Himes.pdf
    • http://loaminoo.linkpc.net/5090095095092099/Runaways-The-Challenge-3-by-Lily-Harlem.pdf
    • http://loaminoo.linkpc.net/1090099099090090093/Crazy-Rich-Power-Scandal-and-Tragedy-Inside-the-Johnson-amp-Johnson-Dynasty-by-Jerry-Oppenheimer.pdf
    • http://loaminoo.linkpc.net/1095098099092097/Dolly-and-the-Doctor-Bird-Johnson-Johnson-3-by-Dorothy-Dunnett.pdf
    • http://loaminoo.linkpc.net/1093099096095093/I-Married-Adventure-The-Lives-of-Martin-and-Osa-Johnson-by-Osa-Johnson.pdf
    • http://loaminoo.linkpc.net/1095098098096093/Ibiza-Surprise-Johnson-Johnson-2-by-Dorothy-Dunnett.pdf
    • http://loaminoo.linkpc.net/2096099092092091/Shower-Power-Peephole-Tug-Johnson-s-Hot-Tales-3-by-Tug-Johnson.pdf
    • http://loaminoo.linkpc.net/1097091092091090/Grand-Slam-Raw-Talent-1-by-Lily-Harlem.pdf
    • http://loaminoo.linkpc.net/3093091094096097/Caught-on-Camera-Part-One-by-Lily-Harlem.pdf
    • http://loaminoo.linkpc.net/4099096090096096/Desk-Job-London-Menage-2-by-Lily-Harlem.pdf
    • http://loaminoo.linkpc.net/2094095091093098/The-Virgin-Sexy-as-Hell-Trilogy-1-by-Harlem-Dae.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.