Malicious PDF — malware analysis report

Static analysis result for SHA-256 6035fb131917c218…

MALICIOUS

PDF

16.0 KB Created: 2019-05-02 11:39:02 +01:00 Authoring application: mPDF 5.7
MD5: 9c624dfd269a0b67bfeca5b59936b518 SHA-1: f031664101e2fc13386c611ee0528f72cf1dbeb6 SHA-256: 6035fb131917c21802fd421cc0aded1394f877150a73503359f6f8e3774fe0cf
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a link farm. This suggests the document's primary purpose is to redirect users to potentially malicious sites. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a dropper.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-9695814-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9695814-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3094093096091095/You-Are-Sloth-by-Steve-Lowe.pdf
    • http://loaminoo.linkpc.net/1090098094098092098/The-Best-Of-Is-It-Just-Me-Or-Is-Everything-Shit-by-Steve-Lowe.pdf
    • http://loaminoo.linkpc.net/2098099095096092/Wolves-Dressed-as-Men-by-Steve-Lowe.pdf
    • http://loaminoo.linkpc.net/1090098094098092093/The-Shape-of-Shit-to-Come-by-Steve-Lowe.pdf
    • http://loaminoo.linkpc.net/2091098091095099/Muscle-Memory-by-Steve-Lowe.pdf
    • http://loaminoo.linkpc.net/1091091097092097096/Liegt-es-an-mir-oder-ist-wirklich-alles-schei-e-Kleines-Universal-Lexikon-des-modernen-Lebens-by-Steve-Lowe.pdf
    • http://loaminoo.linkpc.net/1093094095091097/Sloth-Slept-On-by-Frann-Preston-Gannon.pdf
    • http://loaminoo.linkpc.net/1091094090099091/Jeffrey-and-Sloth-by-Kari-Lynn-Winters.pdf
    • http://loaminoo.linkpc.net/1091093098096096/Sloth-the-Lazy-Dragon-by-Regan-W-H-Macaulay.pdf
    • http://loaminoo.linkpc.net/3094093092090093/Slothilda-Living-the-Sloth-Life-by-Dante-Fabiero.pdf
    • http://loaminoo.linkpc.net/6095094098092/What-She-Saw-by-Sheila-Lowe.pdf
    • http://loaminoo.linkpc.net/3096094097098099/The-Crocodile-Hunter-The-Incredible-Life-and-Adventures-of-Steve-and-Terri-Irwin-by-Steve-Irwin.pdf
    • http://loaminoo.linkpc.net/2094094096094096/Stories-I-Only-Tell-My-Friends-by-Rob-Lowe.pdf
    • http://loaminoo.linkpc.net/1099099095090099/Thornspell-by-Helen-Lowe.pdf
    • http://loaminoo.linkpc.net/4092090096096090/In-the-Family-Way-by-Barry-Lowe.pdf
    • http://loaminoo.linkpc.net/2092093094097098/My-Dad-s-a-Vampire-by-Barry-Lowe.pdf
    • http://loaminoo.linkpc.net/2091092094099090/Seventeen-by-Suzanne-Lowe.pdf
    • http://loaminoo.linkpc.net/4099095094096092/Last-Dog-on-the-Hill-The-Unforgettable-Story-of-Lou-Best-Friend-and-Hero-Steve-Duno-by-Steve-Duno.pdf
    • http://loaminoo.linkpc.net/3092093092091099/Tunnel-Vision-by-Keith-Lowe.pdf
    • http://loaminoo.linkpc.net/1092099092092092/The-Zombie-Always-Knocks-Twice-Hollyweird-1-by-E-Van-Lowe.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.