Malicious PDF — malware analysis report

Static analysis result for SHA-256 704680aa3b273e2b…

MALICIOUS

PDF

14.3 KB Created: 2019-04-30 11:20:46 +01:00 Authoring application: mPDF 5.7
MD5: 4d807f12040f6cc0b6b59cc84291a468 SHA-1: 01d277668e6ac2b6cb8078510ef27db3eb292fb5 SHA-256: 704680aa3b273e2b04f956f782c71203794e997299b9a6cbc69b7766a4cb42e7
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this file as malicious. While the document body is unreadable, the presence of a link farm suggests an attempt to manipulate search engine results or distribute malicious content via these links. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2095092090093093/Club-Dead-Sookie-Stackhouse-3-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/3090094092092098/Club-Dead-Sookie-Stackhouse-3-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/1097090096094093/Club-Dead-Sookie-Stackhouse-3-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/8092095092096091/All-Together-Dead-Sookie-Stackhouse-7-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/7094097096095/Dead-by-Day-Sookie-Stackhouse-4-5-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/3092097093091/All-Together-Dead-Sookie-Stackhouse-7-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/2096099099094098/Dead-Ever-After-Sookie-Stackhouse-13-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/3092097090096/Definitely-Dead-Sookie-Stackhouse-6-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/4099099094092091/Definitely-Dead-Sookie-Stackhouse-6-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/3094090097098094/Definitely-Dead-Sookie-Stackhouse-6-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/4099092097093094/All-Together-Dead-Sookie-Stackhouse-7-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/7099096091099097/From-Dead-to-Worse-Sookie-Stackhouse-8-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/4099090094091091/Dead-Until-Dark-Sookie-Stackhouse-1-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/3094090095096093/From-Dead-to-Worse-Sookie-Stackhouse-8-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/3093099096097097/A-Touch-of-Dead-Sookie-Stackhouse-4-1-4-3-5-1-7-1-8-1-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/2090090092096091/Dead-To-The-World-Sookie-Stackhouse-4-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/3092097092097/Dead-as-a-Doornail-Sookie-Stackhouse-5-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/1097092094092098/Dead-Reckoning-Sookie-Stackhouse-11-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/2099093096093095/Dead-Until-Dark-Sookie-Stackhouse-1-by-Charlaine-Harris.pdf
    • http://loaminoo.linkpc.net/3092096095092/Living-Dead-in-Dallas-Sookie-Stackhouse-2-by-Charlaine-Harris.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.