Malicious PDF — malware analysis report

Static analysis result for SHA-256 77e0784f0896eef5…

MALICIOUS

PDF

12.3 KB Created: 2019-04-30 05:29:41 +01:00 Authoring application: mPDF 5.7
MD5: ad59cf8983988753e1d235d7bb77c90c SHA-1: 0139f183e324d669096a31fbb3402570b84fb62e SHA-256: 77e0784f0896eef5e722744ac5eb22d64e3ff0f02dec86b87708fbcaeb633da8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified as a link farm. The primary heuristic indicates this is a critical finding, suggesting the PDF's purpose is to direct users to a malicious website. While the URLs themselves are currently marked as benign, the sheer volume and structure point towards a malicious intent, likely for SEO manipulation or as a distribution point for further threats. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8780

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7095092092092090/David-Mamet-s-Oleanna-by-David-Sauer.pdf
    • http://loaminoo.linkpc.net/7095092091090099/Romance-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092093095091/School-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092093093097/Henrietta-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092091091092/Faustus-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092092093091/The-Woods-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092092093092/Passover-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/2090098091096095/Race-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/3095098091097091/Speed-the-Plow-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092090092095/House-of-Games-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092090091098/Chicago-A-Novel-of-Prohibition-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092093093095/David-Mamet-by-Dennis-Carroll.pdf
    • http://loaminoo.linkpc.net/7095092093094092/The-Frog-Prince-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092092092097/Jafsie-and-John-Henry-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/2093091090097/Glengarry-Glen-Ross-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092093095092/No-One-Will-Be-Immune-and-Other-Plays-and-Pieces-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092091091098/Wilson-A-Consideration-of-the-Sources-by-David-Mamet.pdf
    • http://loaminoo.linkpc.net/7095092090092093/David-Mamet-in-Conversation-by-Leslie-Kane.pdf
    • http://loaminoo.linkpc.net/7095092092092099/Understanding-David-Mamet-by-Brenda-Murphy.pdf
    • http://loaminoo.linkpc.net/7095092091091091/A-Whore-s-Profession-Notes-and-Essays-by-David-Mamet.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.