Malicious PDF — malware analysis report

Static analysis result for SHA-256 7954fdcfe12bc657…

MALICIOUS

PDF

13.5 KB Created: 2019-05-01 19:30:15 +01:00 Authoring application: mPDF 5.7
MD5: 1c050559c4a9054d38158b588d5d1a5e SHA-1: f2be931dbc85a5b1f8bdfa22d710aaa910f0d5b1 SHA-256: 7954fdcfe12bc657b87f025160d538bd0d24a1e1758440132e3089401cc05f96
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified as a link farm, suggesting a malicious intent to manipulate search engine results or distribute further content. While no scripts were extracted, the presence of numerous external links points towards a potential phishing or SEO poisoning attack. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9877

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2092092099094090/Noah-Could-Never-Noah-Can-t-Even-2-by-Simon-James-Green.pdf
    • http://loaminoo.linkpc.net/1091090094094099095/Summary-Sapiens-A-brief-History-of-Humankind-by-Yuval-Noah-Harari-by-Noah-Fran.pdf
    • http://loaminoo.linkpc.net/2092094091094094/Enrapture-Noah-s-Tryst-Noah-2-by-Pierce-Smith.pdf
    • http://loaminoo.linkpc.net/7096096096092092/The-Days-of-Noah-The-Complete-Box-Set-The-Days-of-Noah-1-3-by-Mark-Goodwin.pdf
    • http://loaminoo.linkpc.net/3094094090095091/The-Collected-Works-of-Noah-Cicero-Vol-I-by-Noah-Cicero.pdf
    • http://loaminoo.linkpc.net/2094099095090091/The-Three-Lives-of-James-Madison-Genius-Partisan-President-by-Noah-Feldman.pdf
    • http://loaminoo.linkpc.net/4095091097096098/Best-Behavior-by-Noah-Cicero.pdf
    • http://loaminoo.linkpc.net/8093090095097091/No-Regrets-by-Noah-Harris.pdf
    • http://loaminoo.linkpc.net/8091099093091097/Nosferatu-by-Noah-Cicero.pdf
    • http://loaminoo.linkpc.net/8091099092096091/Treatise-by-Noah-Cicero.pdf
    • http://loaminoo.linkpc.net/3090097097098/Noah-s-Ark-by-Peter-Spier.pdf
    • http://loaminoo.linkpc.net/2094091095093/Blammo-9-by-Noah-Van-Sciver.pdf
    • http://loaminoo.linkpc.net/1090097093094099099/Maskerade-by-Noah-Berg.pdf
    • http://loaminoo.linkpc.net/1095091096094092/The-Winemaker-by-Noah-Gordon.pdf
    • http://loaminoo.linkpc.net/9097099093090092/Winterland-by-Noah-Moon.pdf
    • http://loaminoo.linkpc.net/7096096096092091/Noah-s-Ark-by-Lucy-Cousins.pdf
    • http://loaminoo.linkpc.net/1099098093094095/The-Noah-Confessions-by-Barbara-Hall.pdf
    • http://loaminoo.linkpc.net/7090090094090/Black-Friday-Vol-1-by-Noah-A-J-Wright.pdf
    • http://loaminoo.linkpc.net/2093097094090099/The-Death-Committee-by-Noah-Gordon.pdf
    • http://loaminoo.linkpc.net/7090095092091094/Noah-amp-Saskia-by-Chris-Anastassiades.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.