Malicious PDF — malware analysis report

Static analysis result for SHA-256 616b17ac6b9bb145…

MALICIOUS

PDF

16.1 KB Created: 2019-05-01 05:11:17 +01:00 Authoring application: mPDF 5.7
MD5: 7fee42ffd3c7af1167aff244f2248cd1 SHA-1: 5c78225ad9881baa0f316d93f57b308517d754a4 SHA-256: 616b17ac6b9bb145772fa365d7b997efd47d9aea0f5e3851dd9806b3a1ee9038
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, identified as a link farm. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves directing users to a multitude of external resources, likely for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9090098095094/A-Matter-of-Honor-by-Brittany-Young.pdf
    • http://loaminoo.linkpc.net/4093099090093/A-Matter-of-Honor-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/3091090098096094/Out-of-the-Shadows-by-Ann-Gimpel.pdf
    • http://loaminoo.linkpc.net/2092095097096097/Gabrielle-s-Cauldron-by-Ann-Gimpel.pdf
    • http://loaminoo.linkpc.net/3091090095090091/Forever-and-a-Day-The-Company-Store-2-by-Ann-Gimpel.pdf
    • http://loaminoo.linkpc.net/2095098098099096/Psyche-s-Search-Transformation-2-by-Ann-Gimpel.pdf
    • http://loaminoo.linkpc.net/4093095096091090/Miranda-s-Mate-The-Company-Store-1-by-Ann-Gimpel.pdf
    • http://loaminoo.linkpc.net/6098094092093090/Honor-1-Protect-Serve-Beat-Burn-Honor-1-by-Bill-Jemas.pdf
    • http://loaminoo.linkpc.net/2094091095092090/By-Honor-Bound-Two-Navy-SEALs-the-Medal-of-Honor-and-a-Story-of-Extraordinary-Courage-by-Tom-Norris.pdf
    • http://loaminoo.linkpc.net/2095099093091090/Echoes-of-Honor-Honor-Harrington-8-by-David-Weber.pdf
    • http://loaminoo.linkpc.net/3093095090095091/The-Honor-of-the-Queen-Honor-Harrington-2-by-David-Weber.pdf
    • http://loaminoo.linkpc.net/1094093098099092/The-Honor-of-Spies-Honor-Bound-5-by-W-E-B-Griffin.pdf
    • http://loaminoo.linkpc.net/2091099096099094/War-of-Honor-Honor-Harrington-10-by-David-Weber.pdf
    • http://loaminoo.linkpc.net/7097094090092/Honor-Student-Honor-1-by-Teresa-Mummert.pdf
    • http://loaminoo.linkpc.net/7096095092095096/Honor-and-Obey-Honor-3-by-Teresa-Mummert.pdf
    • http://loaminoo.linkpc.net/2093093092098095/A-Matter-of-Time-Book-II-A-Matter-of-Time-2-by-Mary-Calmes.pdf
    • http://loaminoo.linkpc.net/1090096097093094/Price-of-Honor-Honor-9-by-Radclyffe.pdf
    • http://loaminoo.linkpc.net/3095096096090092/Word-of-Honor-Honor-7-by-Radclyffe.pdf
    • http://loaminoo.linkpc.net/6099093093094096/Nuclear-Matter-in-Different-Phases-and-Transitions-Proceedings-of-the-Workshop-Nuclear-Matter-in-Different-Phases-and-Transitions-March-31-April-10-1998-Les-Houches-France-by-Jean-Paul-Blaizot.pdf
    • http://loaminoo.linkpc.net/2095095093091091/A-Matter-of-Time-Vol-2-A-Matter-of-Time-3-4-by-Mary-Calmes.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.