Malicious PDF — malware analysis report

Static analysis result for SHA-256 838794eca1a4435a…

MALICIOUS

PDF

18.0 KB Created: 2019-05-01 17:43:01 +01:00 Authoring application: mPDF 5.7
MD5: a28fdcb9643ff12a4cbb857ac471e094 SHA-1: cedc9e84698c7175b75bc594b5336e1ce7418fd8 SHA-256: 838794eca1a4435a5bf11477161352bd190fce5bceecdeb4653e0aeddcbdd229
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by an ML classifier as malicious and contains a large number of embedded links. The heuristic PDF_SEO_LINK_FARM indicates these links are part of a link farm, likely designed to distribute malware or redirect users to malicious content. No scripts were extracted from this sample, but the extensive link farm suggests a delivery mechanism for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6090094099090097/Red-River-Vol-2-Red-River-2-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/6090094099091099/Red-River-Vol-12-Red-River-12-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/6090094099091091/Red-River-Vol-6-Red-River-6-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/6090094099092092/Red-River-Vol-13-Red-River-13-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/6090094099091090/Red-River-Vol-8-Red-River-8-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/4095097098094/Red-River-Vol-1-Red-River-1-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/6090094099096091/Red-River-Vol-16-Red-River-16-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/6090094099090099/Red-River-Vol-4-Red-River-4-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/6090095090090093/-8-Ao-no-Fuuin-8-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/6090095090090091/-5-Ao-no-Fuuin-5-by-Chie-Shinohara.pdf
    • http://loaminoo.linkpc.net/9092098097094094/Nahanni-River-of-Gold-River-of-Dreams-by-Neil-Hartling.pdf
    • http://loaminoo.linkpc.net/7095096094096097/River-in-Ruin-The-Story-of-the-Carmel-River-by-Ray-A-March.pdf
    • http://loaminoo.linkpc.net/1091095099096090/River-River-Wolfe-1-by-Skyla-Dawn-Cameron.pdf
    • http://loaminoo.linkpc.net/3095097093097092/The-Bank-of-the-River-The-River-1-by-Michael-Richan.pdf
    • http://loaminoo.linkpc.net/4095090098095097/River-s-Rescue-River-s-End-9-by-Leanne-Davis.pdf
    • http://loaminoo.linkpc.net/7096095098093094/Lewis-and-Clark-Trail-Maps-Missouri-River-Between-Camp-River-DuBois-Illinois-and-Fort-Mandan-North-Dakota--Outbound-1804-Return-1806-by-Martin-Plamondon.pdf
    • http://loaminoo.linkpc.net/1091090093099098098/Sophy-and-the-River-by-Fawn-River.pdf
    • http://loaminoo.linkpc.net/6098099098090099/The-traveler-s-guide-to-the-Hudson-river-Saratoga-springs-lake-George-falls-of-Niagara-and-Thousand-islands-Montreal-Quebec-and-the-Saguenay-river-by-New-York-quot-American-News-Company-quot-.pdf
    • http://loaminoo.linkpc.net/1090097091091099092/Das-Gl-ck-wartet-in-Virgin-River-Virgin-River-11-by-Robyn-Carr.pdf
    • http://loaminoo.linkpc.net/6090098096093099/Norfolk-Broads-The-Broads-Norfolk-Wherry-Breydon-Water-Halvergate-Marshes-River-Yare-River-Waveney-Aeshna-Isoceles-Martham-Broad-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/1091095099

Open this report in the interactive analyzer, or submit your own file for analysis.