Malicious PDF — malware analysis report

Static analysis result for SHA-256 78d52148b7b125e9…

MALICIOUS

PDF

15.6 KB Created: 2019-04-30 04:30:24 +01:00 Authoring application: mPDF 5.7
MD5: 937998553ec1146c3e9f8e7a1d917a65 SHA-1: 400a3ae2e2fdf2eeb2cc3d2d1b65b13fc5e627d5 SHA-256: 78d52148b7b125e969304dba4c4c4c000b38fb6c31b07e5e5899a7d9b9886a91
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links pointing to external PDF documents hosted on a dynamic DNS domain. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. While no scripts were extracted, the PDF structure and the sheer volume of links strongly suggest a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5095090093098098/Doctor-Who-Shadow-of-Death-Destiny-of-the-Doctor-2-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/5095090094099091/Doctor-Who-The-Yes-Men-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/5095090093092095/Doctor-Who-The-Time-Travellers-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/5095090094093096/Doctor-Who-The-Uncertainty-Principle-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/5095090094090095/Doctor-Who-The-Cold-Equations-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/3092097099092090/Doctor-Who-Short-Trips-The-History-of-Christmas-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/5095090094096095/No-Rest-for-the-Wicked-Graceless-2-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/5095090094094092/The-Wake-Bernice-Summerfield-42-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/5095090093092099/Fire-and-Water-Primeval-8-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/5095090095090091/Sapphire-and-Steel-The-School-by-Simon-Guerrier.pdf
    • http://loaminoo.linkpc.net/9096090091091099/Doctor-Who-City-of-Spires-by-Simon-Bovey.pdf
    • http://loaminoo.linkpc.net/8099090097094094/Doctor-Who-Grimm-Reality-by-Simon-Bucher-Jones.pdf
    • http://loaminoo.linkpc.net/4099092096096097/Doctor-Who-The-Tenth-Doctor-Adventures-10th-Doctor-Audio-Originals-by-Peter-Anghelides.pdf
    • http://loaminoo.linkpc.net/2091091091093098/Doctor-Who-Timeframe-The-Illustrated-History-Doctor-Who-30th-Anniversary-by-David-J-Howe.pdf
    • http://loaminoo.linkpc.net/2090096092094091/Surviving-Doctor-Vincent-The-Good-Doctor-Trilogy-2-by-Renea-Mason.pdf
    • http://loaminoo.linkpc.net/6093091098096090/Doctor-Who-Time-Reaver-The-Tenth-Doctor-Adventures-1-2-by-Jenny-T-Colgan.pdf
    • http://loaminoo.linkpc.net/4091091090098096/Doctor-Who-The-Tenth-Doctor-Vol-2-The-Weeping-Angels-of-Mons-by-Robbie-Morrison.pdf
    • http://loaminoo.linkpc.net/3095091092093094/Curing-Doctor-Vincent-The-Good-Doctor-Trilogy-1-by-Renea-Mason.pdf
    • http://loaminoo.linkpc.net/4090098099097093/Doctor-Who-The-Ninth-Doctor-Vol-1-Weapons-of-Past-Destruction-by-Cavan-Scott.pdf
    • http://loaminoo.linkpc.net/1094097094091096/Doctor-Who-The-Third-Doctor-Volume-1-The-Heralds-of-Destruction-by-Paul-Cornell.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.