Malicious PDF — malware analysis report

Static analysis result for SHA-256 63c20abe6f2f0896…

MALICIOUS

PDF

19.1 KB Created: 2019-04-30 04:41:13 +01:00 Authoring application: mPDF 5.7
MD5: b3e657932a6c8909dea397d6f4f157e6 SHA-1: 718e933bd376ad26e207781de16ffc6a304c29dc SHA-256: 63c20abe6f2f0896ccf5b48e25dd0739f2293a88076ebb6ed169557042badf3f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files hosted on a dynamic DNS domain. This behavior is indicative of a link farm or SEO poisoning tactic, designed to drive traffic to potentially malicious or low-quality content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9094093098/The-Thousand-and-One-The-Crescent-Moon-Kingdoms-2-by-Saladin-Ahmed.pdf
    • http://loaminoo.linkpc.net/4099093091095096/Throne-of-the-Crescent-Moon-The-Crescent-Moon-Kingdoms-1-by-Saladin-Ahmed.pdf
    • http://loaminoo.linkpc.net/2094097098094/Throne-of-the-Crescent-Moon-The-Crescent-Moon-Kingdoms-1-by-Saladin-Ahmed.pdf
    • http://loaminoo.linkpc.net/2093096097094/Black-Bolt-Vol-1-Hard-Time-by-Saladin-Ahmed.pdf
    • http://loaminoo.linkpc.net/2097093098099/Hooves-and-the-Hovel-of-Abdel-Jameela-by-Saladin-Ahmed.pdf
    • http://loaminoo.linkpc.net/5090096090090/Crescent-Moon-Vol-1-Crescent-Moon-1-by-Haruko-Iida.pdf
    • http://loaminoo.linkpc.net/4096098090090096/One-Thousand-Nights-Tales-of-the-Latter-Kingdoms-5-by-Christine-Pope.pdf
    • http://loaminoo.linkpc.net/4099099097092091/Under-the-Crescent-Moon-by-Elizabeth-Green.pdf
    • http://loaminoo.linkpc.net/1099098094093092/Fathom-Crescent-Moon-Bay-1-by-Merrie-Destefano.pdf
    • http://loaminoo.linkpc.net/4096090098098094/Wolves-of-the-Crescent-Moon-by-Yousef-Al-Mohaimeed.pdf
    • http://loaminoo.linkpc.net/3097090098093090/Eclipse-of-the-Crescent-Moon-by-G-za-G-rdonyi.pdf
    • http://loaminoo.linkpc.net/7094098093093092/I-Almost-Forgot-about-the-Moon-The-Disinformation-Campaign-Against-Ahmed-Zaoui-by-Selwyn-Manning.pdf
    • http://loaminoo.linkpc.net/2097094093091090/Harvest-Moon-Tales-of-the-Five-Hundred-Kingdoms-5-5-Chronicles-of-Elantra-0-5-by-Mercedes-Lackey.pdf
    • http://loaminoo.linkpc.net/9097095098094/Works-of-Jules-Verne-Twenty-Thousand-Leagues-Under-the-Sea-A-Journey-to-the-Center-of-the-Earth-From-the-Earth-to-the-Moon-Round-the-Moon-Around-the-World-in-Eighty-Days-by-Jules-Verne.pdf
    • http://loaminoo.linkpc.net/3097094093099090/Three-Kingdoms-Volume-01-Heroes-and-Chaos-Three-Kingdoms-1-by-Wei-Dong-Chen.pdf
    • http://loaminoo.linkpc.net/1093092093092091/Ten-Thousand-Joys-amp-Ten-Thousand-Sorrows-A-Couple-s-Journey-Through-Alzheimer-s-by-Olivia-Ames-Hoblitzelle.pdf
    • http://loaminoo.linkpc.net/1090099091096090/Thousand-Sinful-Kisses-Thousand-Trilogy-1-by-Liam-Levi.pdf
    • http://loaminoo.linkpc.net/3098092098092094/The-Twelve-Kingdoms-The-Talon-of-the-Hawk-The-Twelve-Kingdoms-3-by-Jeffe-Kennedy.pdf
    • http://loaminoo.linkpc.net/2093093099095091/The-Twelve-Kingdoms-The-Vast-Spread-of-the-Seas-The-Twelve-Kingdoms-3-by-Fuyumi-Ono.pdf
    • http://loaminoo.linkpc.net/5093095090094/The-Twelve-Kingdoms-Skies-of-Dawn-The-Twelve-Kingdoms-4-by-Fuyumi-Ono.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.