Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e31de8bbb497982…

MALICIOUS

PDF

14.4 KB Created: 2019-05-02 00:43:46 +01:00 Authoring application: mPDF 5.7
MD5: 7d403e1d7fde0108bda2bca622ee679b SHA-1: d81c7beb784d8c7c5fb8a6a14204de90bbed707f SHA-256: 5e31de8bbb497982c64f80bcd09ea31e9ba2db36d6862c2792de334d0bd97bff
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified as a "PDF_SEO_LINK_FARM" heuristic, which is a common tactic for SEO spam or distributing malicious content. While the URLs themselves are currently marked as benign, the sheer volume and the heuristic firing suggest a malicious intent, likely to lure users to external sites. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5094090095098093/Thor-Marvel-Now-Vol-1-Le-Massacreur-De-Dieux-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/1091096090090096096/The-Mighty-Thor-Volume-5-The-Death-of-the-Mighty-Thor-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/1091096090090090094/The-Unworthy-Thor-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/1091096090090096099/Thor-2014-2015-3-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/2094093092090/Thor-God-of-Thunder-Volume-3-The-Accursed-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/3090094098094091/Wolverine-by-Jason-Aaron-The-Complete-Collection-Volume-1-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/2099098095092/Scalped-Vol-7-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/3090095093091090/Wolverine-and-the-X-Men-Vol-4-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/3090096093091094/Wolverine-and-the-X-Men-Volume-5-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/3090096099091090/Wolverine-and-the-X-Men-Volume-3-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/9096099097091093/Thanos-Rising-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/3093097093094097/Scalped-complete-run-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/2094092099091/Southern-Bastards-Vol-2-Gridiron-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/1091099091099092097/Wolverine-Weapon-X-Volume-1-Adamantium-Men-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/8092095092090097/Ghost-Rider-Trials-and-Tribulations-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/1091096090090097097/Adventures-of-Thor-Thor-goes-Scuba-Diving-by-Nancy-L-Bailey.pdf
    • http://loaminoo.linkpc.net/3096095098097092/Thor-Ramsey-s-Total-Money-Meltdown-A-Proven-Plan-for-Financial-Disaster-by-Thor-Ramsey.pdf
    • http://loaminoo.linkpc.net/2098097099091098/Wolverine-Volume-2-Wolverine-vs-the-X-Men-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/3093099097091090/Star-Wars-Vol-2-Showdown-on-the-Smuggler-s-Moon-Star-Wars-2-by-Jason-Aaron.pdf
    • http://loaminoo.linkpc.net/3093099097093099/Star-Wars-Vol-3-Rebel-Jail-Star-Wars-3-by-Jason-Aaron.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.