Malicious PDF — malware analysis report

Static analysis result for SHA-256 73930394f63ddf57…

MALICIOUS

PDF

16.9 KB Created: 2019-04-30 05:32:19 +01:00 Authoring application: mPDF 5.7
MD5: 0e36a6f000da37544550d622fd98924c SHA-1: 6df4287089827aaf086d480f3ff3f7d2283d8aae SHA-256: 73930394f63ddf57ca9829ed3a54549f6519dc7f886a9a59d2603780209471f7
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm. While the document body is heavily corrupted, the heuristic firings indicate a malicious intent, likely for SEO manipulation or to distribute further payloads. No scripts were extracted, but the sheer volume of links suggests a coordinated effort to direct traffic to potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9099090099094/Sleeping-Beauty-Trilogy-Sleeping-Beauty-1-3-by-A-N-Roquelaure.pdf
    • http://loaminoo.linkpc.net/4093099099091098/The-Claiming-of-Sleeping-Beauty-Sleeping-Beauty-1-by-A-N-Roquelaure.pdf
    • http://loaminoo.linkpc.net/4099093097095093/Beauty-s-Punishment-Sleeping-Beauty-2-by-A-N-Roquelaure.pdf
    • http://loaminoo.linkpc.net/1095095097097091/Beauty-Sleep-A-Retelling-of-Sleeping-Beauty-by-Cameron-Dokey.pdf
    • http://loaminoo.linkpc.net/5094099097092093/About-the-Sleeping-Beauty-by-P-L-Travers.pdf
    • http://loaminoo.linkpc.net/4098091096094098/Sleeping-Beauty-by-Mae-Broadley.pdf
    • http://loaminoo.linkpc.net/1097092092095090/Sleeping-Beauty-by-Vera-Southgate.pdf
    • http://loaminoo.linkpc.net/4091097098096097/Sleeping-Beauty-by-Elle-Lothlorien.pdf
    • http://loaminoo.linkpc.net/8093092090093091/Sleeping-Beauty-by-Mene-Tekel.pdf
    • http://loaminoo.linkpc.net/1093094096095098/Sleeping-Beauty-by-Judith-Michael.pdf
    • http://loaminoo.linkpc.net/3098097097095097/Sleeping-Beauty-by-Phillip-Margolin.pdf
    • http://loaminoo.linkpc.net/4094094091093097/The-Ballad-of-Sleeping-Beauty-by-Gabriel-Benson.pdf
    • http://loaminoo.linkpc.net/1097099094096099/Sleeping-Beauty-WAKES-UP-by-Elle-Lothlorien.pdf
    • http://loaminoo.linkpc.net/8092091097090/Sleeping-Beauty-s-Daughters-by-Diane-Zahler.pdf
    • http://loaminoo.linkpc.net/4091099097095099/Sleeping-Beauty-Indeed-amp-Other-Lesbian-Fairytales-by-JoSelle-Vanderhooft.pdf
    • http://loaminoo.linkpc.net/2099092090090091/Ravish-The-Awakening-of-Sleeping-Beauty-by-Cathy-Yardley.pdf
    • http://loaminoo.linkpc.net/8092090092093094/The-Frog-Prince-Saves-Sleeping-Beauty-by-Charlotte-Guillain.pdf
    • http://loaminoo.linkpc.net/8092099092098094/Casey-Sleeping-Beauty-And-The-Campus-Prince-by-Heart-Yngrid.pdf
    • http://loaminoo.linkpc.net/2090094097090090/Sleeping-Beauty-Faerie-Tale-Collection-2-by-Jenni-James.pdf
    • http://loaminoo.linkpc.net/1090090093093094093/The-Works-of-Dinah-Maria-Mulock-Craik-The-Sleeping-Beauty-In-The-Wood-Cinderella-Beauty-And-The-Beast-Rumpelstilzchen-Little-Red-Riding-Hood-Puss-Prince-and-More-50-Books-and-Stories-by-Dinah-Maria-Mulock-Craik.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.