Malicious PDF — malware analysis report

Static analysis result for SHA-256 6972d264f55e7a2d…

MALICIOUS

PDF

21.0 KB Created: 2019-04-30 04:29:56 +01:00 Authoring application: mPDF 5.7
MD5: 826ec7e7b118f8d094fe17b230f9c122 SHA-1: b33b073ff139ed24c00df15a986a0dc089e373e2 SHA-256: 6972d264f55e7a2db1046f43b99d9cd38bf819cec7c8f1753133651644adcd44
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently flagged as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to host further malicious content. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2092099091097095/Causality-Code-Causality-Code-1-by-Laaerie.pdf
    • http://loaminoo.linkpc.net/6096091094/Code-Girls-The-Untold-Story-of-the-American-Women-Code-Breakers-Who-Helped-Win-World-War-II-by-Liza-Mundy.pdf
    • http://loaminoo.linkpc.net/3099096090096097/Code-Name-Bundle-Includes-Code-Name-3-5-by-Christina-Skye.pdf
    • http://loaminoo.linkpc.net/9095099091096093/A-Code-Of-Love-Code-Breakers-1-by-Jacki-Delecki.pdf
    • http://loaminoo.linkpc.net/3098093090094092/The-Friendship-Code-Girls-Who-Code-1-by-Stacia-Deutsch.pdf
    • http://loaminoo.linkpc.net/8094095098097/Code-Name-Baby-SEAL-and-Code-Name-7-by-Christina-Skye.pdf
    • http://loaminoo.linkpc.net/1098091095094092/Code-Name-Nanny-SEAL-and-Code-Name-5-by-Christina-Skye.pdf
    • http://loaminoo.linkpc.net/1091095092098095094/The-Code-Red-Revolution-How-Thousands-of-People-are-Losing-Weight-and-Keeping-it-Off-WITHOUT-Pills-Shakes-Diet-Foods-or-Exercise-by-Cristy-Code-Red-Nickel.pdf
    • http://loaminoo.linkpc.net/1092095097095097/The-Bar-Code-Prophecy-Bar-Code-3-by-Suzanne-Weyn.pdf
    • http://loaminoo.linkpc.net/4091094090091091/The-Leader-Code-Crack-this-once-hidden-code-to-become-an-effective-leader-by-Dan-Blakeslee.pdf
    • http://loaminoo.linkpc.net/6099090097099091/Le-Code-Civil-Annot-tant-Le-Code-Civil-Du-Bas-Canada-En-Force-Depuis-Le-Premier-Ao-t-1866-Tel-Qu-Amend-Jusqu-Au-1er-Octobre-1879-Auquel-on-a-Ajout-Les-Autorit-s-Cit-es-Par-Les-Codificateurs-Et-Un-Grand-Nombre-D-Autres-R-f-rences-Aux-by-Quebec.pdf
    • http://loaminoo.linkpc.net/3098097090093099/Code-Name-Verity-Code-Name-Verity-1-by-Elizabeth-E-Wein.pdf
    • http://loaminoo.linkpc.net/4092093092091/Code-Name-Verity-Code-Name-Verity-1-by-Elizabeth-E-Wein.pdf
    • http://loaminoo.linkpc.net/5091095090094/Code-of-Silence-Code-of-Silence-1-by-Tim-Shoemaker.pdf
    • http://loaminoo.linkpc.net/8097092090091/Code-Geass-Lelouch-of-the-Rebellion-Vol-3-Code-Geass-Lelouch-of-the-Rebellion-3-by-Ichirou-Ohkouchi.pdf
    • http://loaminoo.linkpc.net/8097090093099/Code-Geass-Lelouch-of-the-Rebellion-Vol-1-Code-Geass-Lelouch-of-the-Rebellion-1-by-Ichirou-Ohkouchi.pdf
    • http://loaminoo.linkpc.net/4098092091099095/The-Code-by-R-J-Scott.pdf
    • http://loaminoo.linkpc.net/5090095092094096/Code-To-Zero-by-Ken-Follett.pdf
    • http://loaminoo.linkpc.net/3093095092099090/CODE-X-Episode-1-by-M-R-Vallone.pdf
    • http://loaminoo.linkpc.net/1096095093099096/Social-Code-by-Cass-Tell.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.