Malicious PDF — malware analysis report

Static analysis result for SHA-256 67d5ab52290e47e6…

MALICIOUS

PDF

19.0 KB Created: 2019-05-01 19:23:18 +01:00 Authoring application: mPDF 5.7
MD5: 4281258096965de8131e47e2012cf320 SHA-1: 85745daf4670f3881b232c1b42ea3dba10e4261c SHA-256: 67d5ab52290e47e6c87f3d16b744e8dff2fdffbad84d1edc2e680444421222c9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, likely intended to overwhelm search engine indexing or distribute content. While the URLs themselves are marked as benign, the sheer volume and the use of a dynamic DNS domain suggest a malicious intent to host or link to potentially harmful content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9940

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3091091097091090/Arthur-s-Valentine-Arthur-Adventure-Series-by-Marc-Brown.pdf
    • http://loaminoo.linkpc.net/5095096095098097/Arthur-s-Chicken-Pox-An-Arthur-Adventure-by-Marc-Brown.pdf
    • http://loaminoo.linkpc.net/3098091093093090/Arthur-s-Halloween-by-Marc-Brown.pdf
    • http://loaminoo.linkpc.net/6097093096099097/Arthur-and-the-True-Francine-by-Marc-Brown.pdf
    • http://loaminoo.linkpc.net/3098096093096097/Arthur-Turns-Green-by-Marc-Brown.pdf
    • http://loaminoo.linkpc.net/3091096092095098/Arthur-s-Lost-Puppy-by-Marc-Brown.pdf
    • http://loaminoo.linkpc.net/7092094092097/Sherlock-Holmes-Series-4-The-Red-headed-League---The-Adventure-of-the-Second-Stain-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/5090092098094096/The-Adventure-of-the-Cardboard-Box-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/3093093095096097/The-Adventure-of-the-Illustrious-Client-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/4092090096098091/The-Adventure-of-the-Priory-School-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/5091093097095099/Quintet-by-Douglas-Arthur-Brown.pdf
    • http://loaminoo.linkpc.net/4095090097097091/The-Adventure-of-the-Bruce-Partington-Plans-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/1090092093094097/The-Adventure-of-the-Bruce-Partington-Plans-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/4097099093090098/The-Adventure-of-the-Crooked-Man-The-Memoirs-of-Sherlock-Holmes-7-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/7093093095097/Sherlock-Holmes---The-Adventure-of-the-Abbey-Grange-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/4096097098096090/The-Adventure-of-the-Speckled-Band-and-Other-Stories-of-Sherlock-Holmes-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/8091092099096/The-Adventure-of-the-Empty-House-The-Return-of-Sherlock-Holmes-1-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/4094090094099096/The-Adventure-of-the-Resident-Patient-The-Memoirs-of-Sherlock-Holmes-8-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/7099099091095/The-Adventure-of-the-Solitary-Cyclist-The-Return-of-Sherlock-Holmes-4-by-Arthur-Conan-Doyle.pdf
    • http://loaminoo.linkpc.net/3098095099097096/The-Adventure-of-the-Reigate-Squire-The-Memoirs-of-Sherlock-Holmes-6-by-Arthur-Conan-Doyle.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.