Malicious PDF — malware analysis report

Static analysis result for SHA-256 77fed4257f4406cd…

MALICIOUS

PDF

16.9 KB Created: 2019-04-30 02:40:21 +01:00 Authoring application: mPDF 5.7 First seen: 2021-10-23
MD5: 5406bf898d2a37dbd7dad2be987b0a1e SHA-1: d5eaa42b7975cefb095a175714a5dcc743322f6d SHA-256: 77fed4257f4406cd3d55eb90bc100320d28d29713892c9aacfb85de5fa047241
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files, many of which are hosted on a dynamic DNS domain. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5097095098095099/Grey---Fifty-Shades-of-Grey-von-Christian-selbst-erz-hlt-Fifty-Shades-4-by-E-L-James.pdf In PDF document text
    • http://loaminoo.linkpc.net/1097091091092090/Meet-Fifty-Shades-Continued---Fifty-Shades-of-Grey-by-G-E-Griffin.pdfIn PDF document text
    • http://loaminoo.linkpc.net/7099093094095/Fifty-Shades-Duo-Fifty-Shades-Darker-Fifty-Shades-Freed-Fifty-Shades-2-3-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1090091090090099/Grey-Fifty-Shades-of-Grey-as-Told-by-Christian-A-11-Minute-HOOOTTTT-summary-by-Bern-Bolo.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1090091094098094097/Fifty-Shades-of-Grey-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1090092091/Grey-Fifty-Shades-4-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6091091093093093/Fifty-Shades-of-Grey-Part-2-of-2-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/7091096093095098/Fifty-Shades-of-Grey-Peninta-apohrosis-tou-Gkri-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1090095095092095096/Satutettu-Fifty-Shades-of-Grey-Christianin-kertomana-2-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6098098096092091/Married-Sex-Fifty-Shades-of-Grey-for-Couples-by-Laina-Charleston.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3093099092094093/Fifty-Shades-of-Lady-Catherine-Grey-The-Sex-Scandals-that-Shook-the-Tudor-Court-by-T-S-Wiseman.pdfIn PDF document text
    • http://loaminoo.linkpc.net/5097095098096097/Darker---Fifty-Shades-of-Grey-Gef-hrliche-Liebe-von-Christian-selbst-erz-hlt-Band-2-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/2094090094099094/Fifty-Shades-Darker-Fifty-Shades-2-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3093092099096093/Fifty-Shades-Freed-Fifty-Shades-3-by-E-L-James.pdfIn PDF document text
    • http://loaminoo.linkpc.net/2094096098098096/A-Girl-s-Adventure-by-Chloe-Thurlow.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3093099090099/Shades-of-Grey-Shades-of-Grey-1-by-Jasper-Fforde.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1097096091091095/Shades-of-Grey-Shades-of-Grey-1-by-Jasper-Fforde.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1091092090094094/Shades-of-Grey-Shades-of-Grey-1-by-Jasper-Fforde.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1097094092090094/Fifty-Shades-of-Naughty-1-of-the-Fifty-Shades-of-Naughty-Trilogy-by-Edward-Naughty.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3090096092096093/Fifty-Shades-of-BDSM-by-Sky-Corgan.pdfIn PDF document text