Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a3362109fccef9d…

MALICIOUS

PDF

16.5 KB Created: 2020-03-15 09:45:17 +00:00 Authoring application: mPDF 5.7
MD5: fb2aec4923e4e24845fa3f1115e9afe5 SHA-1: 98c53e4cbb77274b816c0de869ae5052d94ecf52 SHA-256: 6a3362109fccef9dcb3369883a6311ce9e5766e3910d587d5705e9d04c2184ca
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links, such as http://lwoscmobook.myhome.cx/45246524652495248/Primal-Law-Alpha-Pack-1-by-J-D-Tyler.pdf, likely lead to malicious websites or downloads. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lwoscmobook.myhome.cx/45246524652495248/Primal-Law-Alpha-Pack-1-by-J-D-Tyler.pdf
    • http://lwoscmobook.myhome.cx/152465246524052475244/Primal-Law-Alpha-Pack-1-by-J-D-Tyler.pdf
    • http://lwoscmobook.myhome.cx/252475243524152485241/Unknown-Alpha-Pack-9-by-J-D-Tyler.pdf
    • http://lwoscmobook.myhome.cx/65247524752475245/Cole-s-Redemption-Alpha-Pack-5-by-J-D-Tyler.pdf
    • http://lwoscmobook.myhome.cx/65249524152445245/Wolf-s-Fall-Alpha-Pack-6-by-J-D-Tyler.pdf
    • http://lwoscmobook.myhome.cx/65246524252415245/Hunter-s-Heart-Alpha-Pack-4-by-J-D-Tyler.pdf
    • http://lwoscmobook.myhome.cx/252435241524352415243/Phoenix-Reborn-Alpha-Pack-7-5-by-J-D-Tyler.pdf
    • http://lwoscmobook.myhome.cx/252495249524852405246/Alpha-Bourne-Primal-Heat-1-by-Lynn-Hagen.pdf
    • http://lwoscmobook.myhome.cx/152485243524952485242/Alpha-s-Claim-Manlove-Edition-by-Tyler-Robbins.pdf
    • http://lwoscmobook.myhome.cx/352495244524052445240/Called-to-Mate-Pack-Mates-1-by-Lynn-Tyler.pdf
    • http://lwoscmobook.myhome.cx/352475248524552435244/Mine-to-Keep-Fraser-Lake-Pack-2-by-Lynn-Tyler.pdf
    • http://lwoscmobook.myhome.cx/352475247524852405249/Accidentally-Mated-Fraser-Lake-Pack-1-by-Lynn-Tyler.pdf
    • http://lwoscmobook.myhome.cx/152475244524452425249/Big-Bad-Alpha-The-Ashland-Pack-2-by-Bryce-Evans.pdf
    • http://lwoscmobook.myhome.cx/452475241524252495241/Primal-Body-Primal-Mind-Beyond-Paleo-for-Total-Health-and-a-Longer-Life-by-Nora-Gedgaudas.pdf
    • http://lwoscmobook.myhome.cx/152485244524652425249/The-Alpha-Series-Boxed-Set-Books-1---3-Alpha-Kaden-Alpha-Grayson-and-Alpha-Jasper-by-Midika-Crane.pdf
    • http://lwoscmobook.myhome.cx/352475248524352435241/My-Alpha-s-Ghost-Haunted-Lazarus-Pack-1-by-G-G-G-ricault.pdf
    • http://lwoscmobook.myhome.cx/252495249524452475245/Hunted-Down-by-His-Alpha-Clear-Ridge-Pack-2-by-C-J-Colton.pdf
    • http://lwoscmobook.myhome.cx/152495242524252445242/Chosen-by-the-Alpha-The-Shadow-Pack-Rules-1-by-Michele-Bardsley.pdf
    • http://lwoscmobook.myhome.cx/152485245524752435246/PRIMAL-Fury-PRIMAL-4-by-Jack-Silkstone.pdf
    • http://lwoscmobook.myhome.cx/452485241524752485245/The-Alpha-s-Mate-Huntsville-Pack-1-Sequel-to-Bring-Her-Wolf-by-Michelle-Fox.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.