Malicious PDF — malware analysis report

Static analysis result for SHA-256 72082e8ec8e4d7e7…

MALICIOUS

PDF

18.8 KB Created: 2019-04-30 03:02:58 +01:00 Authoring application: mPDF 5.7
MD5: 528579f4378c4c492d710c4980e52ae5 SHA-1: a9b51a0d0647a9ce6d1a60660a8ff9bbfdf8c5e1 SHA-256: 72082e8ec8e4d7e7888a54fe24e4595ea3f324f1f09f8e84735ebb29baea2482
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on the domain 'seasasac.lflinkup.com'. This heuristic firing, combined with the ML classifier's high confidence, suggests a malicious intent, likely for SEO manipulation or to distribute further payloads. No scripts were extracted, but the structure indicates a potential initial access vector via spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seasasac.lflinkup.com/2da1da0da2da3da4/Before-the-Dawn-by-Carol-Warburton.pdf
    • http://seasasac.lflinkup.com/2da1da0da2da8da4/Eyes-of-a-Stranger-by-Carol-Warburton.pdf
    • http://seasasac.lflinkup.com/2da1da0da3da1da6/Whisper-Hollow-by-Carol-Warburton.pdf
    • http://seasasac.lflinkup.com/2da5da5da1da8da5/Blood-and-Roses-One-Family-s-Struggle-and-Triumph-During-the-Tumultuous-Wars-of-the-Roses-by-Helen-Castor.pdf
    • http://seasasac.lflinkup.com/9da5da8da0da7da0/Austrian-Noble-Houses-House-of-Babenberg-House-of-Schaffgotsch-House-of-Kinsky-House-of-Graben-Von-Stein-House-of-Zierotin-by-Books-LLC.pdf
    • http://seasasac.lflinkup.com/3da3da7da3da8da3/Sleeping-Roses-Dead-Roses-1-by-RaShelle-Workman.pdf
    • http://seasasac.lflinkup.com/3da2da5da8da3da4/The-Desert-King-s-Housekeeper-Bride-The-Royal-House-of-Karedes-8-by-Carol-Marinelli.pdf
    • http://seasasac.lflinkup.com/9da5da2da4da7da6/House-at-Royal-Oak-Starting-Over-amp-Rebuilding-a-Life-One-Room-at-a-Time-by-Carol-Eron-Rizzoli.pdf
    • http://seasasac.lflinkup.com/1da1da8da2da2da9da3/Philosophy-The-Classics-by-Nigel-Warburton.pdf
    • http://seasasac.lflinkup.com/5da7da0da7da4/A-Witch-Alone-Winter-Trilogy-3-by-Ruth-Warburton.pdf
    • http://seasasac.lflinkup.com/1da1da8da2da2da5da2/Free-Speech-A-Very-Short-Introduction-by-Nigel-Warburton.pdf
    • http://seasasac.lflinkup.com/4da1da2da6da2da1/The-Blood-amp-Roses-Series-Box-Set-Blood-amp-Roses-1-6-by-Callie-Hart.pdf
    • http://seasasac.lflinkup.com/3da9da1da1da4da1/Shadowed-by-Ken-Hughes.pdf
    • http://seasasac.lflinkup.com/2da6da3da4da5da8/Shadowed-Souls-by-Jim-Butcher.pdf
    • http://seasasac.lflinkup.com/6da1da1da3da9da1/Shadowed-Flame-by-R-J-Blain.pdf
    • http://seasasac.lflinkup.com/5da6da6da6da8da7/The-Decalogue-Being-the-Warburton-Lectures-Delivered-in-Lincoln-s-Inn-and-Westminster-Abbey-1919-1923-by-R-H-Charles.pdf
    • http://seasasac.lflinkup.com/4da2da8da0da6da1/Shadowed-Lights-by-Ella-M-Kaye.pdf
    • http://seasasac.lflinkup.com/3da7da5da2da7da0/Shadowed-Secrets-by-Lois-Richer.pdf
    • http://seasasac.lflinkup.com/1da1da8da6da2da3/Shadowed-Soul-by-John-M-Spagnoli.pdf
    • http://seasasac.lflinkup.com/2da3da1da2da4da4/Stepping-on-Roses-Vol-1-Stepping-on-Roses-1-by-Rinko-Ueda.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.