Malicious PDF — malware analysis report

Static analysis result for SHA-256 62f6760b9cad59be…

MALICIOUS

PDF

13.5 KB Created: 2019-05-02 17:30:43 +01:00 Authoring application: mPDF 5.7
MD5: 161b0b55ef91aeb901782d9ba456f16e SHA-1: d468943460a5b6cf5dcac939ed063696bc654658 SHA-256: 62f6760b9cad59bedcfb45aed74a912f380d1348d2fb1b9baa378867d3988ca9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. These URLs are likely intended to manipulate search engine rankings or serve as a distribution point for further malicious content. The ML classifier also flagged the document as malicious, supporting this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8098099098095098/Sergej-Jensen-Dogs-by-Sergej-Jensen.pdf
    • http://loaminoo.linkpc.net/1091091091098091093/Lessen-in-Regie-by-Sergej-Michajlovi-Ejsen-tejn.pdf
    • http://loaminoo.linkpc.net/3097094099094094/The-Sierra-Jensen-Series-Boxed-Set-Sierra-Jensen-5-8-by-Robin-Jones-Gunn.pdf
    • http://loaminoo.linkpc.net/8098099099092094/Schwarzes-Eis-Der-Lebensroman-meines-Vaters-by-Sergej-Lochthofen.pdf
    • http://loaminoo.linkpc.net/1091090093096096099/vor-dem-Exitus-zur-ck-in-leben-Heilung-f-r-Geist-und-Seele-gegen-Depressionen-Angst-Phobien-und-Psychosen-by-Sergej-Sergeew.pdf
    • http://loaminoo.linkpc.net/2093090098099090/The-Rapture-by-Liz-Jensen.pdf
    • http://loaminoo.linkpc.net/1099094097097095/Skyscraping-by-Cordelia-Jensen.pdf
    • http://loaminoo.linkpc.net/2096090092097099/Stuck-with-You-by-Trish-Jensen.pdf
    • http://loaminoo.linkpc.net/8097095090094097/Trigger-by-Jasmine-Jensen.pdf
    • http://loaminoo.linkpc.net/8092091099/The-Date-by-Louise-Jensen.pdf
    • http://loaminoo.linkpc.net/3095099098094/The-Sister-by-Louise-Jensen.pdf
    • http://loaminoo.linkpc.net/3097094096091097/The-Third-Wise-Man-by-Muriel-Jensen.pdf
    • http://loaminoo.linkpc.net/4095099095/The-Gift-by-Louise-Jensen.pdf
    • http://loaminoo.linkpc.net/4091090098097/We-the-Drowned-by-Carsten-Jensen.pdf
    • http://loaminoo.linkpc.net/3097096097092/Woven-by-Michael-Jensen.pdf
    • http://loaminoo.linkpc.net/3098099096090098/Unleashed-Unmemorable-2-by-A-P-Jensen.pdf
    • http://loaminoo.linkpc.net/2090099094090092/We-The-Drowned-by-Carsten-Jensen.pdf
    • http://loaminoo.linkpc.net/3095099094/The-Sister-by-Louise-Jensen.pdf
    • http://loaminoo.linkpc.net/1090093094096092/The-First-Risk-by-Charles-Jensen.pdf
    • http://loaminoo.linkpc.net/2091090096099091/Trees-to-Know-in-Oregon-by-Edward-C-Jensen.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.