Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fdf10a00f91cf5a…

MALICIOUS

PDF

14.9 KB Created: 2019-04-28 14:18:35 +01:00 Authoring application: mPDF 5.7
MD5: 20b8790fee959ecd5810ebc5634e317b SHA-1: 15ee4b09cf42309e27ba82928f36c2aefaf1836d SHA-256: 7fdf10a00f91cf5a5f483fcfe26201033263b05d7e7581c4112c7ddb350fb16f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on a dynamic DNS domain, identified by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily obfuscated, the presence of numerous links suggests an attempt to manipulate search engine results or distribute further content. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2098096091099096/Save-Me-Tonight-by-M-P-Wallace.pdf
    • http://loaminoo.linkpc.net/4097094095095094/Moonlight-Murder-The-Last-Poetic-Prose-of-D-B-Wallace-by-D-B-Wallace.pdf
    • http://loaminoo.linkpc.net/7097090090095092/BEN-HUR-THE-FAIR-GOD-amp-THE-PRINCE-OF-INDIA-or-Why-Constantinople-Fell-LEW-WALLACE-PREMIUM-COLLECTION-Timeless-Wisdom-Collection-Book-1825-by-Lew-Wallace.pdf
    • http://loaminoo.linkpc.net/2091091097093099/Save-Save-Me-1-by-Ella-Col.pdf
    • http://loaminoo.linkpc.net/7096098092/If-I-Die-Tonight-by-Alison-Gaylin.pdf
    • http://loaminoo.linkpc.net/2095097098092/The-Way-You-Look-Tonight-by-MacKenzie-Taylor.pdf
    • http://loaminoo.linkpc.net/5093099095097094/Tenting-Tonight-by-James-I-Robertson-Jr-.pdf
    • http://loaminoo.linkpc.net/1098092091094090/Master-For-Tonight-II-by-Elaine-Barris.pdf
    • http://loaminoo.linkpc.net/8098095093/Why-Not-Tonight-Happily-Inc-3-by-Susan-Mallery.pdf
    • http://loaminoo.linkpc.net/4091096099099099/Who-Will-Tuck-Me-In-Tonight-by-Carol-Roth.pdf
    • http://loaminoo.linkpc.net/4093091099096096/Give-Me-Tonight-by-Lisa-Kleypas.pdf
    • http://loaminoo.linkpc.net/2097099094099/No-Bath-Tonight-by-Jane-Yolen.pdf
    • http://loaminoo.linkpc.net/4098097094092/Where-is-My-Wandering-Boy-Tonight-by-David-Wagoner.pdf
    • http://loaminoo.linkpc.net/8092093098/Mister-Tonight-by-Kendall-Ryan.pdf
    • http://loaminoo.linkpc.net/1098091091092097/The-Dragons-are-Singing-Tonight-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/7095094096095093/There-s-a-Party-at-Mona-s-Tonight-by-Harry-Allard.pdf
    • http://loaminoo.linkpc.net/1091093094099094096/All-Yours-Tonight-The-Brazen-Boys-5-by-Daryl-Banner.pdf
    • http://loaminoo.linkpc.net/4095091096090099/After-Tonight-Flirting-With-Trouble-1-by-Annie-Kelly.pdf
    • http://loaminoo.linkpc.net/1094090096092092/Why-Not-Tonight-Harlequin-Blaze-200-by-Jacquie-D-39-Alessandro.pdf
    • http://loaminoo.linkpc.net/1091093093090093098/Where-Will-You-Swim-Tonight-by-Milly-Jane-Limmer.pdf