Malicious PDF — malware analysis report

Static analysis result for SHA-256 5035e1720a7845b1…

MALICIOUS

PDF

17.9 KB Created: 2019-05-01 18:38:25 +01:00 Authoring application: mPDF 5.7
MD5: f4f759020d13b12a56da8ed1ee184c83 SHA-1: 5eb3b72e57175f64754df59671cd62acdb0d7346 SHA-256: 5035e1720a7845b1002bdde2e820943e2dbd9609797c30bbfbb4564adfbe4d5c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. While the linked URLs themselves are currently marked as benign, the overall structure and heuristic firings suggest a malicious intent, likely to direct users to potentially harmful content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.link
    • http://loaminoo.linkpc.net/4093098091096093/The-Naked-Man-Festival-And-Other-Excuses-to-Fly-Around-the-World-by-Brian-Thacker.pdf
    • http://loaminoo.linkpc.net/4093098093098093/I-m-Not-Eating-Any-of-That-Foreign-Muck-Travels-with-Me-Dad-by-Brian-Thacker.pdf
    • http://loaminoo.linkpc.net/5091092098097096/Naked-Ape-Naked-Boss-Bernard-Harrison-The-Man-Behind-the-Singapore-Zoo-and-the-World-s-First-Night-Safari-by-Kirpal-Singh.pdf
    • http://loaminoo.linkpc.net/4094097097092095/Naked-A-Cultural-History-of-American-Nudism-by-Brian-S-Hoffman.pdf
    • http://loaminoo.linkpc.net/8092095091096091/Festival-of-the-Bones-El-Festival-de-Las-Calaveras-The-Book-for-the-Day-of-the-Dead-by-Luis-San-Vicente.pdf
    • http://loaminoo.linkpc.net/8090092097099095/Festival-of-the-Bones-El-Festival-de-las-Calaveras-by-Luis-San-Vicente.pdf
    • http://loaminoo.linkpc.net/7093098092090098/The-Naked-Jape-Uncovering-The-Hidden-World-Of-Jokes-by-Jimmy-Carr.pdf
    • http://loaminoo.linkpc.net/7093098095092096/Naked-Mole-Rats-in-the-World-of-Darkness-A-Burlesque-about-Men-and-Women-by-Mike-Folie.pdf
    • http://loaminoo.linkpc.net/2091093091090098/The-Naked-Baron-Naked-Nobility-2-by-Sally-MacKenzie.pdf
    • http://loaminoo.linkpc.net/1099097094095099/The-Naked-Duke-Naked-Nobility-1-by-Sally-MacKenzie.pdf
    • http://loaminoo.linkpc.net/4093093097099096/Naked-Desire-Naked-Cowboys-5-by-Desiree-Holt.pdf
    • http://loaminoo.linkpc.net/9098096091099097/Business-Exposed-The-Naked-Truth-about-What-Really-Goes-on-in-the-World-of-Business-by-Freek-Vermeulen.pdf
    • http://loaminoo.linkpc.net/2097091090091092/The-Naked-Viscount---Viscount-yang-Telanjang-Naked-Nobility-5-by-Sally-MacKenzie.pdf
    • http://loaminoo.linkpc.net/3091092090099/A-Several-World-by-Brian-Blanchfield.pdf
    • http://loaminoo.linkpc.net/3093094095092094/The-World-of-The-Dark-Crystal-by-Brian-Froud.pdf
    • http://loaminoo.linkpc.net/9093093097098096/Lame-Excuses-by-Alle-Wells.pdf
    • http://loaminoo.linkpc.net/1092098090094092/Where-Excuses-Go-to-Die-by-John-Espinosa-Nelson.pdf
    • http://loaminoo.linkpc.net/8092097098093091/The-Book-of-Excuses-by-Gyles-Brandreth.pdf
    • http://loaminoo.linkpc.net/3099095096091090/Warfare-in-the-Medieval-World-by-Brian-Todd-Carey.pdf
    • http://loaminoo.linkpc.net/1095098090096098/Fall-of-Thanes-The-Godless-World-3-by-Brian-Ruckley.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.