Malicious PDF — malware analysis report

Static analysis result for SHA-256 4df39431c56398dd…

MALICIOUS

PDF

14.1 KB Created: 2019-05-01 17:38:32 +01:00 Authoring application: mPDF 5.7
MD5: d3e00f8d27efaaba77a78d09d49b6a18 SHA-1: 7ab7b4064b035360b175ac6794f4f21e915f07e3 SHA-256: 4df39431c56398dd91afed118a6d00b9692e25f948af390dbd540bfbbf31c09c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm heuristic, indicating a large number of embedded URLs. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the presence of numerous links to external PDFs suggests a potential SEO poisoning or redirection attack. The primary IOCs are the embedded URLs, which are likely used to distribute further malicious content or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1098092097096092/Birthday-Vicious-The-Ashleys-3-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/1098092097096098/Lip-Gloss-Jungle-The-Ashleys-4-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/1098092098091093/Cat-s-Meow-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/2093096094091092/29-Boyfriends-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/6098098092099/Wolf-Pact-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/3093096095098/The-Isle-of-the-Lost-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/2093095097097090/The-Queen-s-Secret-Untitled-1-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/4090099099098091/Frozen-Heart-of-Dread-1-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/8092098/The-Isle-of-the-Lost-Descendants-1-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/1097095092090098/Golden-Heart-of-Dread-3-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/7090093092099/Frozen-Heart-of-Dread-1-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/7098097093/Love-amp-War-Alex-amp-Eliza-2-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/4093096095090094/Masquerade-Blue-Bloods-2-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/7091099094098/The-Isle-of-the-Lost-Descendants-1-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/4091098090095099/Keys-to-the-Repository-Blue-Bloods-4-5-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/1090092090094096/Witches-of-East-End-The-Beauchamp-Family-1-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/2091094095095097/White-Nights-A-Vampires-of-Manhattan-Novel-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/5096098096/Rise-of-the-Isle-of-the-Lost-Descendants-3-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/1098092098094091/The-Strip-Angels-on-Sunset-Boulevard-3-by-Melissa-de-la-Cruz.pdf
    • http://loaminoo.linkpc.net/8098093097094097/The-Desperado-Who-Stole-Baseball-Cruz-de-la-Cruz-1-by-John-H-Ritter.pdf
    • http://loaminoo.linkpc.net/7098097093

Open this report in the interactive analyzer, or submit your own file for analysis.