Malicious PDF — malware analysis report

Static analysis result for SHA-256 65b2cfaddec0c6fa…

MALICIOUS

PDF

14.8 KB Created: 2019-05-07 04:06:05 +01:00 Authoring application: mPDF 5.7
MD5: ecd6cdb62e8650b1423a40158c347e07 SHA-1: 45501f5e18a88de804a35ff84b35e15f42bd9054 SHA-256: 65b2cfaddec0c6faa3937f0633265ae04a48374f8f86163dc6fed6ea66cda5df
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document containing a large number of embedded URLs, identified as a link farm. The ML classifier strongly indicates maliciousness, and the heuristic rule 'PDF_SEO_LINK_FARM' confirms the presence of numerous external links, many with numeric slugs. While the document body is corrupted, the structure and embedded URLs suggest a tactic to redirect users to potentially malicious or SEO-abused content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090097097099099098/Knights-And-Castles-by-Philip-Ardagh.pdf
    • http://loaminoo.linkpc.net/3091094098090092/Castles-on-the-Sand-Shattered-Castles-1-by-E-M-Tippetts.pdf
    • http://loaminoo.linkpc.net/8091092095098092/Castles-of-Britain-and-Ireland-The-Ultimate-Reference-Book-A-Region-By-Region-Guide-to-over-1-350-Castles-by-Peter-Somerset-Fry.pdf
    • http://loaminoo.linkpc.net/3090090090091/The-Chosen-Knights-Secret-Knights-1-by-Mary-Ting.pdf
    • http://loaminoo.linkpc.net/1091092092097095/Ethereal-Knights-Celestra-Knights-1-by-Addison-Moore.pdf
    • http://loaminoo.linkpc.net/2099090094091098/Girls-Can-t-Be-Knights-Spirit-Knights-Book-1-by-Lee-French.pdf
    • http://loaminoo.linkpc.net/1097095093098090/The-Blessed-Knights-Secret-Knights-2-by-Mary-Ting.pdf
    • http://loaminoo.linkpc.net/4096098097094096/Silent-Knights-Knights-1-by-Gale-Stanley.pdf
    • http://loaminoo.linkpc.net/3095099098092099/Twisted-Knights-Angels-and-Demons-Twisted-Knights-MC-1-by-Lauren-Calhoun.pdf
    • http://loaminoo.linkpc.net/4090099098097097/Castles-by-Alan-Lee.pdf
    • http://loaminoo.linkpc.net/1091096094098091/Paper-Castles-by-Terri-Lee.pdf
    • http://loaminoo.linkpc.net/1095090093095090/I-Had-Seen-Castles-by-Cynthia-Rylant.pdf
    • http://loaminoo.linkpc.net/7096097095093095/Cathedrals-and-Castles-by-Henry-James.pdf
    • http://loaminoo.linkpc.net/5092090091098099/The-River-Baptists-by-Belinda-Castles.pdf
    • http://loaminoo.linkpc.net/1097098098098097/Castles-We-Build-by-Alyson-Reuben.pdf
    • http://loaminoo.linkpc.net/6093099098090/Castles-of-Steel-by-Robert-K-Massie.pdf
    • http://loaminoo.linkpc.net/1090091097094/Romancing-the-Duke-Castles-Ever-After-1-by-Tessa-Dare.pdf
    • http://loaminoo.linkpc.net/9095097095094093/Castles-Caves-and-Honeycombs-by-Linda-Ashman.pdf
    • http://loaminoo.linkpc.net/2099093091095097/Castles-The-Frencolian-Chronicles-5-by-Carolyn-Ann-Aish.pdf
    • http://loaminoo.linkpc.net/9097096099096/Realm-of-the-Castles-The-Art-of-Magic-1-by-Sharon-Wheater.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.