Malicious PDF — malware analysis report

Static analysis result for SHA-256 6494c04befde982f…

MALICIOUS

PDF

16.7 KB Created: 2019-05-02 17:55:26 +01:00 Authoring application: mPDF 5.7 First seen: 2021-06-04
MD5: 847335f1f148b22d514700a44fb50651 SHA-1: e60d6d6567078b126662b1ccd7cf66ba75951d76 SHA-256: 6494c04befde982fee6fc248cab611b25333606de61b86de485fef751075f129
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, identified as a link farm. While the document body is unreadable, the heuristic firings strongly suggest a malicious intent to manipulate search engine results or distribute potentially harmful content. No scripts were extracted, but the presence of numerous links points to a phishing or SEO-based distribution tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4094096093096093/Wicked-Izzy-The-Summerland-Trilogy-2-by-Dale-J-Young.pdf In PDF document text
    • http://loaminoo.linkpc.net/4092095090093092/Stillborn-The-Summerland-Trilogy-1-by-Dale-J-Young.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3095095097093/The-Icewind-Dale-Trilogy-Collector-s-Edition-Forgotten-Realms-Icewind-Dale-1-3-Legend-of-Drizzt-4-6-by-R-A-Salvatore.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1096097096098094/Icewind-Dale-Trilogy-Forgotten-Realms-Icewind-Dale-1-3-Legend-of-Drizzt-4-6-by-R-A-Salvatore.pdfIn PDF document text
    • http://loaminoo.linkpc.net/9096097096094098/The-Castell-Brothers-Trilogy-Boxed-Set-by-Izzy-Williams.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3095098092093093/Wicked-A-Wicked-Trilogy-1-by-Jennifer-L-Armentrout.pdfIn PDF document text
    • http://loaminoo.linkpc.net/5090096092096092/Anton-A-Young-Boy-His-Friend-and-the-Russian-Revolution-by-Dale-Eisler.pdfIn PDF document text
    • http://loaminoo.linkpc.net/4098097092095099/Curse-The-Wexkia-Trilogy-1-by-Dale-Furse.pdfIn PDF document text
    • http://loaminoo.linkpc.net/9099094096091095/Famous-Fantasy-Character-Monologs-Starring-the-Not-So-Wicked-Witch-and-More-by-Rebecca-Young.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1092098099093096/Brave-A-Wicked-Trilogy-3-by-Jennifer-L-Armentrout.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3096091092/Torn-A-Wicked-Trilogy-2-by-Jennifer-L-Armentrout.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1098091092095096/A-Touch-So-Wicked-Sin-Trilogy-3-by-Connie-Mason.pdfIn PDF document text
    • http://loaminoo.linkpc.net/4092097094091092/The-King-A-Wicked-Trilogy-3-6-by-Jennifer-L-Armentrout.pdfIn PDF document text
    • http://loaminoo.linkpc.net/4095090096098095/Summerland-by-Michael-Chabon.pdfIn PDF document text
    • http://loaminoo.linkpc.net/5093098091099/The-Young-Merlin-Trilogy-by-Jane-Yolen.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3099090095092091/Sister-Sugar-by-Garden-Summerland.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1099094091093098/Young-Bess-Elizabeth-Trilogy-1-by-Margaret-Irwin.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1093096098095/Passager-The-Young-Merlin-Trilogy-1-by-Jane-Yolen.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3092095096094093/Betrayed-Five-Tales-of-Deceit-by-Garden-Summerland.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3093090098099095/St-Dale-St-Dale-1-by-Sharyn-McCrumb.pdfIn PDF document text