Malicious PDF — malware analysis report

Static analysis result for SHA-256 6594268edc6d999d…

MALICIOUS

PDF

15.7 KB Created: 2019-04-30 18:38:59 +01:00 Authoring application: mPDF 5.7
MD5: 0f5db5dcc498401cf51cd9c0c0b3e99c SHA-1: 45a02faaf3778cd53ac4c80c5fe9ead33d805ab0 SHA-256: 6594268edc6d999d082943cdde61c88d568911c34e8991b246c2b92ee5e53db7
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO manipulation tactic. While the URLs themselves are marked as benign, the sheer volume and the ML classifier's high confidence indicate a malicious intent, likely to distribute further malicious content or engage in SEO spam. No scripts were extracted, but the presence of embedded links points to a potential initial access vector via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2097093092092094/Jacob-King-of-Portalia-The-Pillars-of-Life-Trilogy-1-by-Casey-Clubb.pdf
    • http://loaminoo.linkpc.net/3090098096096091/The-King-Trilogy-Boxed-Set-The-King-Trilogy-1-3-by-Mimi-Jean-Pamfiloff.pdf
    • http://loaminoo.linkpc.net/9097097090096094/A-Life-Less-Stressed-the-five-pillars-of-health-and-wellness-by-Ron-Ehrlich.pdf
    • http://loaminoo.linkpc.net/1098091090090092/The-Magical-Mix-Up-Zach-King-s-Magical-Life-Trilogy-2-by-Zach-King.pdf
    • http://loaminoo.linkpc.net/4093093095098093/IceFlight-Iron-Alter-Trilogy-1-by-Casey-Lea.pdf
    • http://loaminoo.linkpc.net/2096098096092094/King-for-a-Day-The-King-Trilogy-2-by-Mimi-Jean-Pamfiloff.pdf
    • http://loaminoo.linkpc.net/1093094092097093/King-s-The-King-Trilogy-1-by-Mimi-Jean-Pamfiloff.pdf
    • http://loaminoo.linkpc.net/4099096093094/And-Then-There-Was-Life-by-Andr-Jacob.pdf
    • http://loaminoo.linkpc.net/1092093097090094/The-Seer-King-The-Seer-King-Trilogy-1-by-Chris-Bunch.pdf
    • http://loaminoo.linkpc.net/5092090090090097/A-Frontier-Life-Jacob-Hamblin-Explorer-and-Indian-Missionary-by-Todd-M-Compton.pdf
    • http://loaminoo.linkpc.net/7090090096098/Life-Remembering-Martin-Luther-King-Jr-His-Life-and-Crusade-in-Pictures-by-Editorial-Department.pdf
    • http://loaminoo.linkpc.net/4092097094091092/The-King-A-Wicked-Trilogy-3-6-by-Jennifer-L-Armentrout.pdf
    • http://loaminoo.linkpc.net/3093098092/End-of-Watch-Bill-Hodges-Trilogy-3-by-Stephen-King.pdf
    • http://loaminoo.linkpc.net/4092092097091097/The-Runaway-King-The-Ascendance-Trilogy-2-by-Jennifer-A-Nielsen.pdf
    • http://loaminoo.linkpc.net/1095093096094098/Mother-of-a-King-KIYA-Trilogy-2-by-Katie-Hamstead.pdf
    • http://loaminoo.linkpc.net/1096094098092090/The-Ten-Club-The-King-Trilogy-5-by-Mimi-Jean-Pamfiloff.pdf
    • http://loaminoo.linkpc.net/1095093094094091/The-Bastard-King-Norman-Trilogy-1-by-Jean-Plaidy.pdf
    • http://loaminoo.linkpc.net/3096099099094095/The-Runaway-King-The-Ascendance-Trilogy-2-by-Jennifer-A-Nielsen.pdf
    • http://loaminoo.linkpc.net/6090090090099/The-Tainted-Trust-The-King-Trilogy-2-by-Stephen-Douglass.pdf
    • http://loaminoo.linkpc.net/2090096097091099/The-Ten-Club-The-King-Trilogy-5-by-Mimi-Jean-Pamfiloff.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.