Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f27014cef2708c7…

MALICIOUS

PDF

16.2 KB Created: 2019-04-30 05:19:06 +01:00 Authoring application: mPDF 5.7
MD5: 7cd59ab713cfb2e994c02db96f63da08 SHA-1: b09eb2debf62efb518a4c55f76b3ec40c1bbc0af SHA-256: 5f27014cef2708c734afc9be32ea81ba06937ad46b946f71667b9f1d0bc4b71e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDFs, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier also flagged this PDF as malicious. The embedded URLs point to a domain with a suspicious structure, suggesting a link farm or a distribution point for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9098094098090097/Thus-Spoke-Zarathustra-A-Book-For-All-And-None-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/6094099090095095/Also-sprach-Zarathustra-Ein-Buch-f-r-alle-und-keinen-by-Friedrich-Wilhelm-Nietzsche-Friedrich-Nietzsche-Fritz-Koegel-Publication-date-1907-by-Friedrich-Wilhelm-Nietzsche.pdf
    • http://loaminoo.linkpc.net/3094097091097/Thus-Spake-Zarathustra-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/9098099096093098/Also-sprach-Zarathustra-Gesamtausgabe-in-4-B-nden-Ein-Buch-f-r-Alle-und-Keinen-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/2092092091093099/Basic-Writings-of-Nietzsche-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/1090095099091097091/Nietzsche-s-Zarathustra-by-Kathleen-Marie-Higgins.pdf
    • http://loaminoo.linkpc.net/1090095099093091098/Zarathustra-s-Last-Supper-Nietzsche-s-Eight-Higher-Men-by-Weaver-Santaniello.pdf
    • http://loaminoo.linkpc.net/4098092093096094/A-Nietzsche-Reader-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/8098098092093091/Nietzsche-F-r-Anf-nger-Also-Sprach-Zarathustra-Eine-Lese-Einf-hrung-by-R-diger-Schmidt.pdf
    • http://loaminoo.linkpc.net/1090093091090090090/Al-m-do-bem-e-do-mal-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/9097095094099090/Joyful-Wisdom-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/8094095097099099/Mas-alla-del-bien-y-del-mal-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/4091093096093091/Beyond-Good-And-Evil-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/3099096097092097/Twilight-of-the-Idols-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/6090099094093091/Schopenhauer-as-Educator-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/8098099094098098/Beyond-Good-and-Evil-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/2091095095093098/The-Anti-Christ-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/9099098096093095/Beyond-Good-and-Evil-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/8098097099099/The-Pre-Platonic-Philosophers-by-Friedrich-Nietzsche.pdf
    • http://loaminoo.linkpc.net/3096090099095/The-Anti-Christ-by-Friedrich-Nietzsche.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.