Malicious PDF — malware analysis report

Static analysis result for SHA-256 62fa2044b499252b…

MALICIOUS

PDF

17.8 KB Created: 2019-05-01 17:48:49 +01:00 Authoring application: mPDF 5.7
MD5: ffb9aba9f6fcf0e1545f5e908cc2e47c SHA-1: d2db3d93d8a6894545e45e39023c6a211e3c8e13 SHA-256: 62fa2044b499252b1926a8cdd07e42814e7431bc5f0cf13131c84e31e68a22b1
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a malicious intent to redirect users. While the document body is unreadable, the presence of numerous links to external PDFs, even if currently marked as benign, indicates a pattern of link farming. The ML_NYX_PDF_MALICIOUS heuristic further supports the classification of this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1094092098092098/A-Novel-Bookstore-by-Laurence-Coss-.pdf
    • http://loaminoo.linkpc.net/3099094098095093/The-Lady-in-Medieval-England-1000-1500-by-Peter-R-Coss.pdf
    • http://loaminoo.linkpc.net/5099093090096092/Mr-Penumbra-s-24-Hour-Bookstore-Mr-Penumbra-s-24-Hour-Bookstore-1-by-Robin-Sloan.pdf
    • http://loaminoo.linkpc.net/1097093098098098/Mr-Penumbra-s-24-Hour-Bookstore-Mr-Penumbra-s-24-Hour-Bookstore-1-by-Robin-Sloan.pdf
    • http://loaminoo.linkpc.net/1090095096091090/The-Bookstore-by-Deborah-Meyler.pdf
    • http://loaminoo.linkpc.net/2098092095095/Adult-Bookstore-by-Karl-Shapiro.pdf
    • http://loaminoo.linkpc.net/1090095093093091095/The-Classic-Works-of-Laurence-Oliphant-by-Laurence-Oliphant.pdf
    • http://loaminoo.linkpc.net/2091093096095093/Mr-Penumbra-s-24-Hour-Bookstore-by-Robin-Sloan.pdf
    • http://loaminoo.linkpc.net/3093092097090095/Bookstore-Lore-by-The-Staff-at-Tro-Harper-Books.pdf
    • http://loaminoo.linkpc.net/8094092097090091/Overhead-Crane-Taining-Pack-by-ITI-bookstore.pdf
    • http://loaminoo.linkpc.net/4099095095094095/Staurolite-Enchanted-Bookstore-Legend-4-by-Marsha-A-Moore.pdf
    • http://loaminoo.linkpc.net/1090095093091096095/Laurence-Oliphant-Memoir-of-the-life-of-Laurence-Oliphant-and-of-Alice-Oliphant-his-wife-by-Mrs-Oliphant.pdf
    • http://loaminoo.linkpc.net/5093094091099097/M-P-nombre-libraire-ouvert-jour-et-nuit-Mr-Penumbra-s-24-Hour-Bookstore-1-by-Robin-Sloan.pdf
    • http://loaminoo.linkpc.net/3098091093099091/My-Bookstore-Writers-Celebrate-Their-Favorite-Places-to-Browse-Read-and-Shop-by-Ronald-Rice.pdf
    • http://loaminoo.linkpc.net/9094090094098/The-Book-Itch-Freedom-Truth-amp-Harlem-s-Greatest-Bookstore-by-Vaunda-Micheaux-Nelson.pdf
    • http://loaminoo.linkpc.net/6095099097092099/The-Collected-Poetry-of-Paul-Laurence-Dunbar-by-Paul-Laurence-Dunbar.pdf
    • http://loaminoo.linkpc.net/3098097093099096/Holy-Crap-The-World-is-Ending-How-a-Trip-to-the-Bookstore-Led-to-Sex-with-an-Alien-and-the-Destruction-of-Earth-The-Anunnaki-Chronicles-1-by-Anna-Marie-Abell.pdf
    • http://loaminoo.linkpc.net/2095099094091095/Ajax-Penumbra-1969-Mr-Penumbra-s-24-Hour-Bookstore-0-5-by-Robin-Sloan.pdf
    • http://loaminoo.linkpc.net/1090097093092093099/Upstairs-at-the-Strand-Writers-in-Conversation-at-the-Legendary-Bookstore-by-Jessica-Strand.pdf
    • http://loaminoo.linkpc.net/3093099092096091/Found-at-the-Bookstore-Found-2-by-Christi-Snow.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.