Malicious PDF — malware analysis report

Static analysis result for SHA-256 8205419a1cda114a…

MALICIOUS

PDF

15.1 KB Created: 2019-04-30 04:49:19 +01:00 Authoring application: mPDF 5.7
MD5: c11ec43f9be4282d653bbb9d908a2603 SHA-1: 1562506d0a234c84000e5dc508bcf2b185bbde30 SHA-256: 8205419a1cda114a8b99cae8d758dd26d7547483d936f63aa12504c9e756fa8f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to host further malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5099091094091099/Transactions-of-the-Flesh-A-Homage-to-Joris-Karl-Huysmans-by-D-P-Watt.pdf
    • http://loaminoo.linkpc.net/5099091095090093/Obras---Coleccion-de-Joris-Karl-Huysmans-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/5099091094095092/Huysmans---Oeuvres-LCI-72-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/7095099095097092/Against-the-Grain-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/5099091094091094/Becalmed-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/6093096097094097/Against-the-Grain-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/2099098090093096/Against-the-Grain-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/5099091094091093/The-Cathedral-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/5099091094092096/The-Oblate-of-St-Benedict-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/5099091094093092/The-Vatard-Sisters-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/5099091094092090/Parisian-Sketches-by-Joris-Karl-Huysmans.pdf
    • http://loaminoo.linkpc.net/5099091094093095/Joris-Karl-Huysmans-by-Alain-Vircondelet.pdf
    • http://loaminoo.linkpc.net/1098091099090096/Flesh-and-Feathers-The-Flesh-Series-1-by-April-Fifer.pdf
    • http://loaminoo.linkpc.net/1096090096094/Homage-to-Clio-by-W-H-Auden.pdf
    • http://loaminoo.linkpc.net/1091090091/A-Pound-of-Flesh-A-Pound-of-Flesh-1-by-Sophie-Jackson.pdf
    • http://loaminoo.linkpc.net/8097097093091092/Karl-Schneeberg-und-das-Alte-Testament-in-Mecklenburger-Platt-by-Karl-Heinz-Madauss.pdf
    • http://loaminoo.linkpc.net/4096090094094098/Homage-to-Catalonia-by-George-Orwell.pdf
    • http://loaminoo.linkpc.net/1091096098099098099/Der-F-rst-der-Bleichgesichter-Teil-1-Jubil-umsausgabe-zum-100-Todestag-von-Karl-May-by-Karl-May.pdf
    • http://loaminoo.linkpc.net/9098096096090096/Karl-May---Im-Reiche-des-silbernen-Loewen---Doppel-Band-I-und-II-by-Karl-May.pdf
    • http://loaminoo.linkpc.net/9091091090093096/Sacrament-Homage-to-a-River-by-Geoffrey-Fricker.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.