Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e4b746ae9f66150…

MALICIOUS

PDF

19.9 KB Created: 2019-04-30 05:13:58 +01:00 Authoring application: mPDF 5.7
MD5: f84894fbfd3181a95ee5967d85efc3f4 SHA-1: a4835d3784486a11371d23d89db67dccedcfcdeb SHA-256: 5e4b746ae9f66150b5256cd20da88c3354546d77e13c18e6790c75484b1bc874
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, indicating a link farm or SEO spamming attempt. The ML classifier also flagged this PDF as malicious. While the document body is heavily obfuscated, the presence of numerous URLs suggests a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5094095095095/Model-Under-Cover-A-Crime-of-Fashion-by-Carina-Axelsson.pdf
    • http://loaminoo.linkpc.net/1099096098099095/Model-Under-Cover-Stolen-with-Style-by-Carina-Axelsson.pdf
    • http://loaminoo.linkpc.net/4096091098096099/Model-Undercover-London-by-Carina-Axelsson.pdf
    • http://loaminoo.linkpc.net/3090099098094093/My-Vampire-Cover-Model-Cover-Models-1-by-Karyn-Gerrard.pdf
    • http://loaminoo.linkpc.net/3094097091096093/Victoria-s-Secret-Fashion-Model-Literally-by-Hanhan-Tomlinson.pdf
    • http://loaminoo.linkpc.net/2093098099092098/Pricing-Beauty-The-Making-of-a-Fashion-Model-by-Ashley-Mears.pdf
    • http://loaminoo.linkpc.net/8092093099092093/Confessions-of-an-autistic-and-sexually-confused-international-model-The-true-story-of-a-fashion-carreer-by-Agata-Y-M-F-Decroix.pdf
    • http://loaminoo.linkpc.net/4093094099099094/Raiders-of-the-Lost-Corset-Crime-of-Fashion-4-by-Ellen-Byerrum.pdf
    • http://loaminoo.linkpc.net/5095091090094097/LARME-005-Sweet-Girly-Artbook---Model-Fashion-Book-Town-MOOK-Japanese-Edition-by-LARME.pdf
    • http://loaminoo.linkpc.net/2092098098095094/Cover-to-Cover-by-George-Weidenfeld-amp-Nicholson-Ltd.pdf
    • http://loaminoo.linkpc.net/8097091091098098/The-Model-Book-Model-werden-mit-perfekter-Modelmappe-Modelagentur-DIY---Do-it-yourself-by-Stephan-Czaja.pdf
    • http://loaminoo.linkpc.net/4092093098099090/I-m-No-Angel-From-Victoria-s-Secret-Model-to-Role-Model-by-Kylie-Bisutti.pdf
    • http://loaminoo.linkpc.net/1091096096097094099/Fashion-Zeitgeist-Trends-and-Cycles-in-the-Fashion-System-by-Barbara-Vinken.pdf
    • http://loaminoo.linkpc.net/4093092094094094/Crimes-of-Fashion-Three-Women-One-Fashion-Empire-Six-Claws-by-Jonathan-Soroff.pdf
    • http://loaminoo.linkpc.net/1090093097093091098/50s-Fashion-Vintage-Fashion-and-Beauty-Ads-by-Jim-Heimann.pdf
    • http://loaminoo.linkpc.net/1091098095094099092/A-differential-item-functioning-model-for-testlet-based-items-using-a-bi-factor-multidimensional-item-response-theory-model-A-Bayesian-approach-by-Hirotaka-Fukuhara.pdf
    • http://loaminoo.linkpc.net/7099093098093090/Reykjavik-by-Ragnar-Axelsson.pdf
    • http://loaminoo.linkpc.net/8095090092091095/Noveller-f-r-v-rldens-barn-2010-by-Majgull-Axelsson.pdf
    • http://loaminoo.linkpc.net/5093096095091099/Crime-And-The-Law-The-Social-History-Of-Crime-In-Western-Europe-Since-1500-by-V-A-C-Gatrell.pdf
    • http://loaminoo.linkpc.net/6094091093099093/A-Secret-Affair-by-Carina-Adams.pdf