Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d2eb9d9c44c6455…

MALICIOUS

PDF

29.7 KB Created: 2019-04-30 04:05:13 +01:00 Authoring application: mPDF 5.7
MD5: 1ffdc1002487793ef746edabacb04022 SHA-1: 758f48c07b5bdcee98cc267d4c23ef73e3c8c8c7 SHA-256: 4d2eb9d9c44c645532ea9226fd066b4aa518bf2530f70545b8ee0c5a6935f98b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged this PDF as malicious with a high probability. While the document body text is unreadable, the presence of numerous links suggests a phishing or redirection attempt to external sites. The primary IOCs are the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9885

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091099093093093096/Mumien-Spannende-Todesf-lle-geheimnisvolle-Leichname-mit-einem-Pr-parator-auf-Spurensuche-in-alten-Gr-ften-by-Alfred-Riepertinger.pdf
    • http://loaminoo.linkpc.net/9098097090093096/Der-geheimnisvolle-M-nch-by-Alfred-Bekker.pdf
    • http://loaminoo.linkpc.net/8096097097090095/Die-Geheimnisvolle-Insel-Grossdruck-Alle-Drei-Teile-in-Einem-Buch-by-Jules-Verne.pdf
    • http://loaminoo.linkpc.net/9094094096098090/In-einem-alten-Land-eine-Reise-in-die-Vergangenheit-des-Orient-by-Amitav-Ghosh.pdf
    • http://loaminoo.linkpc.net/1090097090099096091/Romantic-Thriller-Doppelband-6-Der-Orden-der-Maske-Irgendwann-in-einem-anderen-Leben-by-Alfred-Bekker.pdf
    • http://loaminoo.linkpc.net/1090099097093091093/-ber-die-Dichtkunst-beim-Aristoteles-Neu-bersetzt-und-mit-Einleitung-und-einem-erkl-renden-Namen--und-Sachverzeichnis-versehen-von-Alfred-Gudemann-1921-by-Aristotle.pdf
    • http://loaminoo.linkpc.net/1091094092095091095/Amalie-Von-Burgau-Oder-Schauerscenen-in-Unterirdischen-Kl-ften-Eine-Wundergeschichte-Nat-rlichen-Inhalts-Aus-Den-Zeiten-Des-Drei-igj-hrigen-Krieges-by-Ludwig-Dellarofa.pdf
    • http://loaminoo.linkpc.net/1091092092097098096/Auf-Spurensuche-in-Der-Familiengeschichte-Vergessen-Und-Erinnern-in-Der-Deutschsprachigen-Gegenwartsliteratur-by-Carina-Malcherek.pdf
    • http://loaminoo.linkpc.net/1091093095093094099/Im-Banne-der-Zauberin-Morgan---Spurensuche-an-magischen-Orten-in-Cornwall-und-Somerset-Ein-Fantasy--und-Reiseroman-by-Barbara-Ortwein.pdf
    • http://loaminoo.linkpc.net/1090098095099092091/Hitlers-Weg-Nach-N-rnberg-Verf-hrer-T-uscher-Massenm-rder-Eine-Spurensuche-In-Franken-Mit-Hundert-Bilddokumenten-by-Egon-Fein.pdf
    • http://loaminoo.linkpc.net/1091092094095097099/-Spurlos-Verschwunden---Die-Spuren-Eines-Kriminalfalls-Deuten-Und-in-Eine-Spannende-Geschichte-Einbauen-Deutsch-Klasse-7-by-Jennifer-Raab.pdf
    • http://loaminoo.linkpc.net/1090098091099090093/Der-Wildnis-entkommen---Die-Geschichten-meiner-Vorbilder---wahre-spannende-und-tragische-Begebenheiten-an-den-entlegensten-Orten-der-Erde-by-Bear-Grylls.pdf
    • http://loaminoo.linkpc.net/1090091093092099095/Geheimnisvolle-Orgelpfeifen-by-Eckhard-Schr-der.pdf
    • http://loaminoo.linkpc.net/1090091093092099098/Geheimnisvolle-Ozeane-by-Michael-Schneider.pdf
    • http://loaminoo.linkpc.net/3091098096093094/Alfred-Hitchcock-s-Monster-Museum-Twelve-Shuddery-Stories-for-Daring-Young-Readers-by-Alfred-Hitchcock.pdf
    • http://loaminoo.linkpc.net/9092091099090094/Leuchtturm-der-Abenteuer-Tim-und-der-Weltuntergang-Lisas-Sicht-auf-die-spannende-magische-und-lustige-Kinderbuch-Reihe-ab-6-Jahren---Kinderb-cher-f-r-Leseanf-nger-by-Karim-Pieritz.pdf
    • http://loaminoo.linkpc.net/7099092098094097/The-Complete-Writings-of-Alfred-de-Musset-Lorenzaccio-the-Chandler-Prudence-Spurns-a-Wager-by-Alfred-de-Musset.pdf
    • http://loaminoo.linkpc.net/8092092090096094/In-Memoriam-by-Alfred-Lord-Tennyson-Edited-with-Notes---Scholar-s-Choice-Edition-by-Alfred-Tennyson.pdf
    • http://loaminoo.linkpc.net/1091095096099096098/Andromache-und-das-geheimnisvolle-Amulett-by-Samuriel-Sternenfeuer.pdf
    • http://loaminoo.linkpc.net/1091090095090091099/Mia-and-me-Band-08-Mia-und-die-geheimnisvolle-Laterne-by-Isabella-Mohn.pdf
    • http://loaminoo.linkpc.net/1090099097093091093/-ber-die-Dichtkunst-beim-Aristoteles-Neu-bersetzt-und-mit-Einleit

Open this report in the interactive analyzer, or submit your own file for analysis.