Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c812535f96aee13…

MALICIOUS

PDF

19.8 KB Created: 2019-05-02 07:29:08 +01:00 Authoring application: mPDF 5.7
MD5: feedb2173b6bfa405975d2288ed0c031 SHA-1: 089272c6b6be1bf4d2b5e0bf1c0c3f79a88d350c SHA-256: 6c812535f96aee1319067cad1ee69ad4eeab46499008135a2ed71192419a71a4
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign-looking book titles, the sheer volume and the use of a dynamic DNS hostname suggest a potential attempt to manipulate search engine rankings or distribute malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5091098095098098/Building-a-Bridge-to-the-18th-Century-How-the-Past-Can-Improve-Our-Future-by-Neil-Postman.pdf
    • http://loaminoo.linkpc.net/1091097091095094098/Conserving-Client-Portfolios-During-Retirement-by-William-P-Bengen.pdf
    • http://loaminoo.linkpc.net/5090094090098096/Mindful-Teaching-and-Teaching-Mindfulness-A-Guide-for-Anyone-Who-Teaches-Anything-by-Deborah-Schoeberlein-David.pdf
    • http://loaminoo.linkpc.net/6094090095093097/God-in-Pain-Teaching-Sermons-on-Suffering-Teaching-Sermons-Series-by-Barbara-Brown-Taylor.pdf
    • http://loaminoo.linkpc.net/3098093091094095/Shakespeare-Set-Free-Teaching-Hamlet-and-Henry-IV-Part-I-by-Teaching-Shakespeare-Institute.pdf
    • http://loaminoo.linkpc.net/4090093094093098/The-Postman-by-David-Brin.pdf
    • http://loaminoo.linkpc.net/3097092093093097/The-Postman-by-David-Brin.pdf
    • http://loaminoo.linkpc.net/3097096091099093/The-Postman-by-David-Brin.pdf
    • http://loaminoo.linkpc.net/1097095096096095/The-Postman-by-Antonio-Sk-rmeta.pdf
    • http://loaminoo.linkpc.net/2094099090096099/Please-Mr-Postman-by-Alan-Johnson.pdf
    • http://loaminoo.linkpc.net/4096099091091099/Postman-Pat-s-Difficult-Day-by-John-Cunliffe.pdf
    • http://loaminoo.linkpc.net/3095092094091/The-Postman-Always-Rings-Twice-by-James-M-Cain.pdf
    • http://loaminoo.linkpc.net/4099093090096092/The-Postman-Always-Rings-Twice-by-James-M-Cain.pdf
    • http://loaminoo.linkpc.net/9091092099098/The-Jolly-Christmas-Postman-by-Janet-Ahlberg.pdf
    • http://loaminoo.linkpc.net/3093091096093096/The-Jolly-Pocket-Postman-by-Janet-Ahlberg.pdf
    • http://loaminoo.linkpc.net/3099095094094098/Teaching-Willow-Session-Two-Teaching-Willow-2-by-Paige-James.pdf
    • http://loaminoo.linkpc.net/1094091096091090/The-Peculiar-Life-of-a-Lonely-Postman-by-Denis-Th-riault.pdf
    • http://loaminoo.linkpc.net/9099092098096091/Nightcrawler-s-10-Commandments-for-Farang-Men-in-Thailand-Cardinal-Rules-for-Dealing-with-a-Thai-Girlfriend-or-Thai-Wife-and-Her-Family-While-Conserving-Your-Financial-Resources-and-Your-Wellbeing-in-the-Land-of-Smiles-by-I-M-Wermes.pdf
    • http://loaminoo.linkpc.net/7097098097090094/Shreveport-and-Bossier-City-Photographs-and-Text-by-Neil-Johnson-With-a-Foreword-by-Jim-Montgomery-by-Neil-Johnson.pdf
    • http://loaminoo.linkpc.net/1090097095093098097/Radio-Activity-by-Bill-Fitzhugh.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.