Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e8bbfb805a5a667…

MALICIOUS

PDF

16.5 KB Created: 2019-05-02 02:09:26 +01:00 Authoring application: mPDF 5.7
MD5: c1696564de0d99d99528cd9d948357e9 SHA-1: 33dac8f74ccbbeb7c714d83a17b98faf6b01f735 SHA-256: 4e8bbfb805a5a667a1451ffe84cabe1fb5f6b1aed6e62e43592448eb60c3dc50
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the specific URLs are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to distribute further malicious content. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6099090092099098/The-Lion-s-Embrace-by-Marie-Laval.pdf
    • http://loaminoo.linkpc.net/6099090093093092/The-Dream-Catcher-Dancing-for-the-Devil-1-by-Marie-Laval.pdf
    • http://loaminoo.linkpc.net/9097090098099/Immortal-Embrace-Embrace-Series-Book-1-by-Charlotte-Blackwell.pdf
    • http://loaminoo.linkpc.net/3093094092097097/Embrace-The-Embrace-Series-1-by-Jessica-Shirvington.pdf
    • http://loaminoo.linkpc.net/5092092090092090/Dangerous-Embrace-Embrace-1-by-Dana-Mason.pdf
    • http://loaminoo.linkpc.net/1099099091090091/Embrace-My-Reflection-Embrace-1-by-T-A-Chase.pdf
    • http://loaminoo.linkpc.net/6097096098094090/Red-Lion-Blue-Lion-WARS-The-Battle-of-Phobos---Gongen-Part-2-of-3-by-Sabrina-Fried.pdf
    • http://loaminoo.linkpc.net/2095093095095098/A-Lion-Called-Christian-The-True-Story-of-the-Remarkable-Bond-Between-Two-Friends-and-a-Lion-by-Anthony-Bourke.pdf
    • http://loaminoo.linkpc.net/5091092095093093/3-1-3-gatsu-no-Lion-1-March-comes-in-like-a-lion-1-by-Chica-Umino.pdf
    • http://loaminoo.linkpc.net/6099090093098094/Montreal-amp-Laval-by-MapArt.pdf
    • http://loaminoo.linkpc.net/8091091094097097/Moi-Jos-e-Laval-by-Yves-Pourcher.pdf
    • http://loaminoo.linkpc.net/6099090093090091/Pierre-Laval-by-Jean-Paul-Cointet.pdf
    • http://loaminoo.linkpc.net/6099090093092092/Colors-Board-Book-by-Thierry-Laval.pdf
    • http://loaminoo.linkpc.net/6099090092098094/Leap-to-Freedom-Healing-Quantum-Guilt-by-Devrah-Laval.pdf
    • http://loaminoo.linkpc.net/1090093094093095090/Nur-ein-kleiner-Schritt-weit-entfernt-Hardcore-Thriller-by-K-Y-Laval.pdf
    • http://loaminoo.linkpc.net/1094098095099092/Lion-s-Blood-Lion-s-Blood-1-by-Steven-Barnes.pdf
    • http://loaminoo.linkpc.net/1090095097098095/The-Clay-Lion-The-Clay-Lion-1-by-Amalie-Jahn.pdf
    • http://loaminoo.linkpc.net/6092096097092091/Lais-of-Marie-de-France-Chevrefoil-Eliduc-Yonec-Guigemar-Lanval-Bisclavret-Le-Fresne-the-Lais-of-Marie-de-France-Lastic-Equitan-by-Marie-Dec-France.pdf
    • http://loaminoo.linkpc.net/2091095091090093/Marie-Th-r-se-Child-of-Terror-The-Fate-of-Marie-Antoinette-s-Daughter-by-Susan-Nagel.pdf
    • http://loaminoo.linkpc.net/4092095098096095/Marie-Th-r-se-Child-of-Terror-The-Fate-of-Marie-Antoinette-s-Daughter-by-Susan-Nagel.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.