Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c85454154ec3572…

MALICIOUS

PDF

18.2 KB Created: 2019-05-01 18:31:40 +01:00 Authoring application: mPDF 5.7
MD5: 1821439e1ac289c149c58ba7e1f11f60 SHA-1: e8c7d5ac55d9872bdaa5a624f8160f54fd168196 SHA-256: 6c85454154ec35727f794d06246be63ec4948816a0c12912f32860cd5a8f6dcc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO poisoning attack. The ML classifier and ClamAV detection confirm its malicious nature. While no scripts were explicitly extracted, the structure and heuristics point towards a dropper or downloader functionality, likely initiated via a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7202694-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7202694-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8093096090093094/Louis-Pasteur-s-Studies-on-Fermentation-The-Diseases-of-Beer-Their-Causes-and-the-Means-of-Preventing-Them-by-Louis-Pasteur.pdf
    • http://loaminoo.linkpc.net/8093096091090091/Louis-Pasteur-by-Liz-Miles.pdf
    • http://loaminoo.linkpc.net/5096095095093096/The-Argument-against-Louis-Pasteur-by-Mur-Lafferty.pdf
    • http://loaminoo.linkpc.net/8093095099095094/Collected-Writings-by-Louis-Pasteur.pdf
    • http://loaminoo.linkpc.net/8093095099094091/Louis-Pasteur-by-Patrice-Debr-.pdf
    • http://loaminoo.linkpc.net/8093096091093090/The-Life-of-Louis-Pasteur-by-Marcia-Newfield.pdf
    • http://loaminoo.linkpc.net/8093095099096097/Louis-Pasteur-And-Pasteurization-by-Jennifer-Fandel.pdf
    • http://loaminoo.linkpc.net/8093096091090094/Louis-Pasteur-Revolutionary-Scientist-by-Allison-Lassieur.pdf
    • http://loaminoo.linkpc.net/8093096091090093/Louis-Pasteur-His-Life-and-Labours-by-Ren-Vallery-Radot.pdf
    • http://loaminoo.linkpc.net/8093096090099099/Germ-Hunter-A-Story-about-Louis-Pasteur-by-Elaine-Marie-Alphin.pdf
    • http://loaminoo.linkpc.net/8093096091090097/Pasteur-Isozyme-Ellis-Horwood-books-in-the-biological-sciences-by-PASTEUR.pdf
    • http://loaminoo.linkpc.net/8093096090093093/Pasteur-and-After-Pasteur-by-Stephen-Paget.pdf
    • http://loaminoo.linkpc.net/1090096090096093099/St-Louis-Missouri-Bauwerk-in-St-Louis-Person-St-Louis-Sport-St-Louis-Olympische-Sommerspiele-1904-Marilyn-Vos-Savant-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/6096094096098092/Les-Rois-de-France-Louis-XIII-Louis-XIV-Louis-XV-Louis-XVI-by-Jean-Christian-Petitfils.pdf
    • http://loaminoo.linkpc.net/2091091098096097/Motive-Means-and-Opportunity-by-Louis-H-Campbell.pdf
    • http://loaminoo.linkpc.net/8093095099095095/Pasteur-Exposed-by-Ethel-Hume.pdf
    • http://loaminoo.linkpc.net/8093095099094092/Pasteur-s-Fight-Against-Microbes-by-Beverley-Birch.pdf
    • http://loaminoo.linkpc.net/8093094093092095/Si-cle-de-Louis-XIV-Vol-1-Auquel-on-a-Joint-Un-Pr-cis-Du-Si-cle-de-Louis-XV-Et-Un-Autre-Morceau-D-Histoire-by-Voltaire.pdf
    • http://loaminoo.linkpc.net/7096091092091/Ride-the-River-Louis-Lamour-Collection-by-Louis-L-39-Amour.pdf
    • http://loaminoo.linkpc.net/6093095095092091/Institut-Pasteur-Scientific-Research-and-Remedies-of-Tomorrow-by-Marie-Neige-Cordonnier.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.