Malicious PDF — malware analysis report

Static analysis result for SHA-256 5378dc1a91b0eaa8…

MALICIOUS

PDF

18.4 KB Created: 2019-04-30 05:31:12 +01:00 Authoring application: mPDF 5.7
MD5: bfac31d15922d7c6e8af0379bd9cb7bd SHA-1: e99dcb9ae6f0202d43db7a3d51a5628f148ff294 SHA-256: 5378dc1a91b0eaa8f21ae497390e20a8d7b0fbd8f093fefc49351208d2930e3e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute further malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7091090094095099/Ellroy-Confidential-Scrivere-e-vivere-a-Los-Angeles-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/7093091094092099/La-Dalia-Negra-Cuarteto-de-Los-ngeles-1-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/4091094098095/The-Big-Nowhere-L-A-Quartet-2-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/7091090094090097/This-Storm-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/1093092091094097/Perfidia-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/4099092095095097/Killer-on-the-Road-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/9097094098099/Killer-on-the-Road-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/3094097093097/The-Black-Dahlia-L-A-Quartet-1-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/4095091092099099/The-Best-American-Noir-of-the-Century-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/3095093094094/American-Tabloid-Underworld-USA-1-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/5096092096098098/Suicide-Hill-Lloyd-Hopkins-3-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/7091090094091094/The-Big-Somewhere-Essays-on-James-Ellroy-s-Noir-World-by-Steven-Powell.pdf
    • http://loaminoo.linkpc.net/7091090095095091/American-Tabloid-and-The-Cold-Six-Thousand-Underworld-U-S-A-Trilogy-Vol-1-by-James-Ellroy.pdf
    • http://loaminoo.linkpc.net/7091090094096094/Novels-by-James-Ellroy-Study-Guide-American-Tabloid-White-Jazz-Blood-s-a-Rover-Killer-on-the-Road-the-Black-Dahlia-by-Books-LLC.pdf
    • http://loaminoo.linkpc.net/7091090094092094/Mauvaise-Etoile-by-R-J-Ellroy.pdf
    • http://loaminoo.linkpc.net/7091090093094094/The-Ellroy-Deflection-by-D-K-Thomas.pdf
    • http://loaminoo.linkpc.net/5099095096097098/Slalom-tra-le-parole-Scrivere-per-sorprendere-coinvolgere-comunicare-Scrivere-per-sorprendere-coinvolgere-comunicare-by-Daniela-Salina.pdf
    • http://loaminoo.linkpc.net/4093097096097092/The-Los-Angeles-Diaries-A-Memoir-by-James-Brown.pdf
    • http://loaminoo.linkpc.net/6093093090090093/Film-Realise-Par-John-Carpenter-La-Nuit-Des-Masques-Los-Angeles-2013-Assaut-Fog-New-York-1997-the-Thing-Christine-Invasion-Los-Angeles-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/8097097091095092/Scrivere-narrativa-5---Presentarsi-agli-editori-by-Marco-P-Massai.pdf
    • http://loaminoo.linkpc.net/7091090095095091/American-Tabloid-and-The-Cold-Six-Thousand-Underworld-U-S-A-Trilo

Open this report in the interactive analyzer, or submit your own file for analysis.