Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b0be49776b22dad…

MALICIOUS

PDF

17.2 KB Created: 2019-05-02 19:07:02 +01:00 Authoring application: mPDF 5.7
MD5: b4dd5d4eb9b49a4650e2bafcfa89238c SHA-1: 05198a0d7f055c352149940dd11fe19d7e71c589 SHA-256: 4b0be49776b22dadbc4cbe5e2d638c28d45562983f6474335121f4db78533fb4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO spam or to redirect users to malicious sites. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2099093093094092/Exquisite-Trouble-Iron-Horse-MC-1-by-Ann-Mayburn.pdf
    • http://loaminoo.linkpc.net/3095099093099093/Exquisite-Trouble-Iron-Horse-MC-1-by-Ann-Mayburn.pdf
    • http://loaminoo.linkpc.net/4095096095094096/Exquisite-Redemption-Iron-Horse-MC-3-by-Ann-Mayburn.pdf
    • http://loaminoo.linkpc.net/4098093099096092/Exquisite-Karma-Iron-Horse-MC-4-by-Ann-Mayburn.pdf
    • http://loaminoo.linkpc.net/9094099091091097/Iron-Fey-Series-Volume-1-The-Iron-King-Winter-s-Passage-The-Iron-Daughter-The-Iron-Queen-Summer-s-Crossing-by-Julie-Kagawa.pdf
    • http://loaminoo.linkpc.net/6091098094092097/The-Iron-Horse-by-Jean-Michel-Charlier.pdf
    • http://loaminoo.linkpc.net/4096095097090090/The-Trouble-with-Being-a-Horse-by-Emily-Edwards.pdf
    • http://loaminoo.linkpc.net/5099094092097096/The-Last-Iron-Horse-The-Kingdom-of-Walden-Series-2-by-Kristan-Cannon.pdf
    • http://loaminoo.linkpc.net/1091097090093099098/The-Clockwork-God-Aboard-the-Great-Iron-Horse-1-by-Jamie-Sedgwick.pdf
    • http://loaminoo.linkpc.net/8093092095099098/Horse-Trouble-Saddle-Club-23-by-Bonnie-Bryant.pdf
    • http://loaminoo.linkpc.net/3094092090096099/Exquisite-Exquisite-1-by-Ella-Frank.pdf
    • http://loaminoo.linkpc.net/1095099090092098/Exquisite-Exquisite-1-by-Ella-Frank.pdf
    • http://loaminoo.linkpc.net/6099092095094/Exquisite-Exquisite-1-by-Ella-Frank.pdf
    • http://loaminoo.linkpc.net/8092092095092098/Iron-Rails-Iron-Men-and-the-Race-to-Link-the-Nation-The-Story-of-the-Transcontinental-Railroad-by-Martin-W-Sandler.pdf
    • http://loaminoo.linkpc.net/1097098098092095/Iron-amp-Wine-The-Iron-World-Series-1-by-Candace-Osmond.pdf
    • http://loaminoo.linkpc.net/6095095098092/The-Iron-Duke-Iron-Seas-1-by-Meljean-Brook.pdf
    • http://loaminoo.linkpc.net/9094099091091095/Iron-King-4-The-Iron-Fey-Manga-4-by-Julie-Kagawa.pdf
    • http://loaminoo.linkpc.net/1091091098096090/The-Horse-Charmer-Phantom-Stallion-Wild-Horse-Island-1-by-Terri-Farley.pdf
    • http://loaminoo.linkpc.net/4093096093090091/Wonder-Horse-The-True-Story-of-the-World-s-Smartest-Horse-by-Emily-Arnold-McCully.pdf
    • http://loaminoo.linkpc.net/4096096090098099/Cross-Train-Your-Horse-Book-One-Simple-Dressage-for-Every-Horse-Every-Sport-by-Jane-Savoie.pdf
    • http://loaminoo.linkpc.net/3094092090096099/Exquisite-Exqui

Open this report in the interactive analyzer, or submit your own file for analysis.