Malicious PDF — malware analysis report

Static analysis result for SHA-256 6be47e51f0eccc9f…

MALICIOUS

PDF

20.8 KB Created: 2019-05-01 05:14:23 +01:00 Authoring application: mPDF 5.7
MD5: 0c81bfbd025eef0f798eb77db1fc097e SHA-1: 46517ebffdf7e6564f83b3780f5393ac2ad1889a SHA-256: 6be47e51f0eccc9fad020821e14d32d6114baf56c4321db76adb0fdecbf5c2b6
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged this sample with high confidence. The document body, though heavily obfuscated, contains URLs pointing to what appears to be a collection of book PDFs, suggesting a potential SEO manipulation or content hosting scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9096092090094099/Hexen-Kuss-Gesamtausgabe-Teile-1-4-Liebes-Zauber-Werwolf-Fluch-Vollmond-Vampire-und-Herz-Klopfen-by-Tatana-Fedorovna.pdf
    • http://loaminoo.linkpc.net/9096092090094097/Hexen-Kuss-Liebes-Zauber-Werwolf-Fluch-Vollmond-Vampire-Sammelband-Teile-1-3-by-Tatana-Fedorovna.pdf
    • http://loaminoo.linkpc.net/9096091099099090/Hexen-Kuss-Vollmond-Vampire-Liebe-Fluch-und-Leidenschaft-by-Tatana-Fedorovna.pdf
    • http://loaminoo.linkpc.net/1091092091093099090/Hexen-Kuss-Liebes-Zauber-Sonderedition---Leidenschaft-des-Blutes-by-T-Fedorovna.pdf
    • http://loaminoo.linkpc.net/9096092090099098/Wenn-Hexen-Vampire-bei-Vollmond-k-ssen-ist-der-Werwolf-sauer-Gesamtausgabe-B-nde-1---3-by-Mia-Dako.pdf
    • http://loaminoo.linkpc.net/9096092090094092/Wenn-Hexen-Vampire-bei-Vollmond-k-ssen-ist-der-Werwolf-sauer-by-Mia-Dako.pdf
    • http://loaminoo.linkpc.net/9092095097090098/Roter-Zauber-Band-2-Wei-er-Fluch-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/1090094090092092093/Der-Fluch-der-Kelten-Gesamtausgabe-by-Patricia-Jankowski.pdf
    • http://loaminoo.linkpc.net/1091093093092097097/Zauber-der-Elemente-Gesamtausgabe-Band-1-4-by-Daphne-Unruh.pdf
    • http://loaminoo.linkpc.net/1091092097092090098/Ein-Werwolf-zum-Dessert-amp-Ein-Werwolf-zum-Nachtisch-Sammelband-Teil-5-amp-6-Prickelnde-Gestaltwandler-Romance-Ein-Werwolf-zum-3-by-Natalie-Salkin.pdf
    • http://loaminoo.linkpc.net/8098091092092096/Ein-Werwolf-zum-Lunch-Samantha-und-Tyler-Werwolf-Erotik-Ein-Werwolf-zum-2-by-Natalie-Salkin.pdf
    • http://loaminoo.linkpc.net/8098091092093093/Ein-Werwolf-zum-Tee-Philipp-amp-Rachel-Ein-Werwolf-zum-3-by-Natalie-Salkin.pdf
    • http://loaminoo.linkpc.net/1090091092098093090/Harvard---Herz-an-Herz-Operation-Heartbreaker-5-by-Suzanne-Brockmann.pdf
    • http://loaminoo.linkpc.net/8099099095091098/Herz-in-Scherben-Herz-aus-Glas-2-by-Kathrin-Lange.pdf
    • http://loaminoo.linkpc.net/9098092096099091/Liebes-gro-e-Brust-by-Sam-Milton.pdf
    • http://loaminoo.linkpc.net/1090093098099098096/Liebes-Hertz-Physiker-Und-Mathematiker-in-Anekdoten-by-Anita-Ehlers.pdf
    • http://loaminoo.linkpc.net/4099094098090095/Kiera-Hudson-Limited-Edition-Series-One-Vampire-Shift-Vampire-Wake-amp-Vampire-Hunt-Book-1-by-Tim-O-39-Rourke.pdf
    • http://loaminoo.linkpc.net/9096091099090090/MORBUS-3-Bei-Vollmond-bist-du-tot-by-Zo-Angel.pdf
    • http://loaminoo.linkpc.net/9096091098092099/Hei-er-Vollmond-Teil1-by-Caroline-Summer.pdf
    • http://loaminoo.linkpc.net/1090093096091095095/Scharfe-Teile-best-gay-erotica-by-Jesse-Grant.pdf