Malicious PDF — malware analysis report

Static analysis result for SHA-256 77ea7b0832ecb704…

MALICIOUS

PDF

16.5 KB Created: 2019-04-30 01:57:24 +01:00 Authoring application: mPDF 5.7
MD5: b4fa8a8d9d857f5876dc2209f49367ed SHA-1: b17bf8b2cb5fa53edea0b1949e01e898f76cb999 SHA-256: 77ea7b0832ecb704775c3c2c35623e29f6c09fd17c043e7cce86c39d56667747
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to serve as a distribution point for further malware. The ML classifier strongly supports the malicious verdict. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3090098097094093/The-Hidden-Stairs-and-the-Magic-Carpet-The-Secrets-of-Droon-1-by-Tony-Abbott.pdf
    • http://loaminoo.linkpc.net/3092092094092096/The-Hidden-Stairs-and-the-Magic-Carpet-by-Tony-Abbott.pdf
    • http://loaminoo.linkpc.net/7097091093093/Kringle-by-Tony-Abbott.pdf
    • http://loaminoo.linkpc.net/1096093098093/The-Postcard-by-Tony-Abbott.pdf
    • http://loaminoo.linkpc.net/2099094091092092/The-Forbidden-Stone-The-Copernicus-Legacy-1-by-Tony-Abbott.pdf
    • http://loaminoo.linkpc.net/2095092096096093/Hidden-Magic-An-Ancient-Magic-1-by-Stephany-Wallace.pdf
    • http://loaminoo.linkpc.net/1091095091097093093/The-Ghost-Road-The-Haunting-of-Derek-Stone-Book-4-by-Tony-Abbott.pdf
    • http://loaminoo.linkpc.net/1091092099090095/The-Secrets-of-Boys-by-Hailey-Abbott.pdf
    • http://loaminoo.linkpc.net/6098095096098093/House-of-Mystery-The-Magic-Science-of-David-P-Abbott-Volume-1-by-Teller.pdf
    • http://loaminoo.linkpc.net/6098095096099098/House-of-Mystery-The-Magic-Science-of-David-P-Abbott-Volume-2-by-Teller.pdf
    • http://loaminoo.linkpc.net/3099090098092092/Hidden-Secrets-by-Cait-London.pdf
    • http://loaminoo.linkpc.net/3095092099097093/Seventh-Mark---Part-1-Hidden-Secrets-1-1-by-W-J-May.pdf
    • http://loaminoo.linkpc.net/2090093096091096/A-Hidden-Magic-by-Vivian-Vande-Velde.pdf
    • http://loaminoo.linkpc.net/7097096097098/Hidden-Magic-Dragon-s-Gift-The-Huntress-0-5-by-Linsey-Hall.pdf
    • http://loaminoo.linkpc.net/2092099096096097/The-Book-of-Secrets-Unlocking-the-Hidden-Dimensions-of-Your-Life-by-Deepak-Chopra.pdf
    • http://loaminoo.linkpc.net/7096095094095092/Secrets-of-the-Tomb-Skull-and-Bones-the-Ivy-League-and-the-Hidden-Paths-of-Power-by-Alexandra-Robbins.pdf
    • http://loaminoo.linkpc.net/7090090099090092/Secrets-of-My-Magic-by-David-Devant.pdf
    • http://loaminoo.linkpc.net/1094091092094098/Secrets-of-the-Lost-Mode-of-Prayer-The-Hidden-Power-of-Beauty-Blessings-Wisdom-and-Hurt-by-Gregg-Braden.pdf
    • http://loaminoo.linkpc.net/7094092095096096/Hidden-in-Plain-Sight-Serenity-s-Plain-Secrets-4-by-Karen-Ann-Hopkins.pdf
    • http://loaminoo.linkpc.net/5094097093091/Tesoro-Secrets-of-the-Hidden-Treasure-The-Tesoro-Series-1-by-Andrea-Hintz.pdf
    • http://loaminoo.linkpc.net/2090093096091096/A

Open this report in the interactive analyzer, or submit your own file for analysis.