Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b5ec9f5f95d51ae…

MALICIOUS

PDF

13.7 KB Created: 2019-05-04 12:32:44 +01:00 Authoring application: mPDF 5.7
MD5: 38bee83b94cdaf2877f295d854cce3c9 SHA-1: 0ad32717a69355b94917a28eb627020790bd207b SHA-256: 4b5ec9f5f95d51aee28502131fe3affb792f06ee5e389dbb617030a7b5bd6140
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to what appears to be a link farm for pirated books. The heuristic PDF_SEO_LINK_FARM specifically identified this behavior, indicating a malicious intent to drive traffic to these external resources. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8099093095097/Deep-Blue-Waterfire-Saga-1-by-Jennifer-Donnelly.pdf
    • http://loaminoo.linkpc.net/1098097099/Dark-Tide-Waterfire-Saga-3-by-Jennifer-Donnelly.pdf
    • http://loaminoo.linkpc.net/4092098094094096/Revolution-by-Jennifer-Donnelly.pdf
    • http://loaminoo.linkpc.net/4099095094091090/Revolution-by-Jennifer-Donnelly.pdf
    • http://loaminoo.linkpc.net/2098097097096/Revolution-by-Jennifer-Donnelly.pdf
    • http://loaminoo.linkpc.net/3091096097094/A-Northern-Light-by-Jennifer-Donnelly.pdf
    • http://loaminoo.linkpc.net/3098093094095/Beauty-and-the-Beast-by-Jennifer-Donnelly.pdf
    • http://loaminoo.linkpc.net/4098096099093098/A-Northern-Light-by-Jennifer-Donnelly.pdf
    • http://loaminoo.linkpc.net/1097094094094091/Deep-Blue-Blue-1-by-Jules-Barnard.pdf
    • http://loaminoo.linkpc.net/2097090099099090/Words-in-Deep-Blue-by-Cath-Crowley.pdf
    • http://loaminoo.linkpc.net/1097090098094098/Words-in-Deep-Blue-by-Cath-Crowley.pdf
    • http://loaminoo.linkpc.net/3098094093095095/Deep-Blue-Doc-Ford-23-by-Randy-Wayne-White.pdf
    • http://loaminoo.linkpc.net/2091090094098098/Deep-Blue-Eyes-and-Other-Lies-by-Janette-Rallison.pdf
    • http://loaminoo.linkpc.net/3091090093090098/At-Home-Between-the-Devil-and-the-Deep-Blue-Sky-by-KoKo-Nervelli.pdf
    • http://loaminoo.linkpc.net/4094091090091091/Scott-Walker-A-Deep-Shade-of-Blue-by-Mike-Watkinson.pdf
    • http://loaminoo.linkpc.net/7097095095099/The-Deep-Blue-Good-By-Travis-McGee-1-by-John-D-MacDonald.pdf
    • http://loaminoo.linkpc.net/1099091092094099/Between-The-Devlin-And-The-Deep-Blue-Seas-Les-Norton-5-by-Robert-G-Barrett.pdf
    • http://loaminoo.linkpc.net/1096099093095/The-Deep-Blue-Alibi-Solomon-vs-Lord-2-by-Paul-Levine.pdf
    • http://loaminoo.linkpc.net/4099096095094092/The-Deep-Blue-Good-By-Travis-McGee-1-by-John-D-MacDonald.pdf
    • http://loaminoo.linkpc.net/3094092095090095/The-Deep-Blue-Good-by-Travis-McGee-1-by-John-D-MacDonald.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.