Malicious PDF — malware analysis report

Static analysis result for SHA-256 840ded348444d9de…

MALICIOUS

PDF

17.6 KB Created: 2019-05-02 01:36:31 +01:00 Authoring application: mPDF 5.7
MD5: f6edf204639c897690cbe9be76562148 SHA-1: d7d82e52de05fb73dd7289a6c53fa13066e06593 SHA-256: 840ded348444d9deab0fea26e3ae72cb2177308ccd2d876066a812f391e7428b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing attempt. While no scripts were extracted, the embedded links themselves are the primary attack vector. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3090098092094095/DC-Super-Friends-Volume-4-Mystery-in-Space-by-Sholly-Fisch.pdf
    • http://loaminoo.linkpc.net/9093092092095090/DC-Super-Friends-Volume-2-Calling-All-Super-Friends-by-Sholly-Fisch.pdf
    • http://loaminoo.linkpc.net/9093092093090097/DC-Super-Friends-Wanted-The-Super-Friends-by-Sholly-Fisch.pdf
    • http://loaminoo.linkpc.net/9093092092095092/DC-Super-Friends-Dinosaur-Round-Up-by-Sholly-Fisch.pdf
    • http://loaminoo.linkpc.net/9093092091095096/Gen-Version-2-0-by-Sholly-Fisch.pdf
    • http://loaminoo.linkpc.net/9093092091096092/Teen-Titans-Go-2014--3-by-Sholly-Fisch.pdf
    • http://loaminoo.linkpc.net/9093092091096096/Teen-Titans-Go-2013--Vol-2-Welcome-to-the-Pizza-Dome-by-Sholly-Fisch.pdf
    • http://loaminoo.linkpc.net/3093097095092093/Super-Galactic-Space-Explorers---Volume-1-by-Jay-Paulin.pdf
    • http://loaminoo.linkpc.net/9093091099099098/Halloween-Comic-Fest-2014---Scooby-Doo-Team-Up-1-featuring-Batman-2014--1-by-Sholly-Fisch.pdf
    • http://loaminoo.linkpc.net/9093092093090096/Fisch-and-Spehlmann-s-Eeg-Primer-Basic-Principles-of-Digital-and-Analog-Eeg-by-Bruce-J-Fisch.pdf
    • http://loaminoo.linkpc.net/1098095093096097/The-Amazing-Super-Great-Awesome-Incredible-Fantastic-Space-Race-by-Othen-Donald-Dale-Cummings.pdf
    • http://loaminoo.linkpc.net/1091098094093094099/Pete-Von-Sholly-s-Morbid-by-Pete-Von-Sholly.pdf
    • http://loaminoo.linkpc.net/3091095090090/Cover-Up-Mystery-at-the-Super-Bowl-The-Sports-Beat-3-by-John-Feinstein.pdf
    • http://loaminoo.linkpc.net/1091093097092096/Santa-s-Rescue-Dog-US-Volume-5-Super-Speed-Sam-by-Monty-J-McClaine.pdf
    • http://loaminoo.linkpc.net/5094095091097/Real-Fake-Nancy-Drew-Girl-Detective-Super-Mystery-3-by-Carolyn-Keene.pdf
    • http://loaminoo.linkpc.net/3092097094099096/High-Survival-Nancy-Drew-and-the-Hardy-Boys-Super-Mystery-10-by-Carolyn-Keene.pdf
    • http://loaminoo.linkpc.net/3096091099098098/The-Death-of-Friends-Henry-Rios-Mystery-5-by-Michael-Nava.pdf
    • http://loaminoo.linkpc.net/1099091098099/The-Death-of-Friends-Henry-Rios-Mystery-5-by-Michael-Nava.pdf
    • http://loaminoo.linkpc.net/1096093090095094/42-amp-Beyond-A-Space-Opera-Anthology-42-amp-Beyond-Series-Volume-2-by-Iris-Sweetwater.pdf
    • http://loaminoo.linkpc.net/1096093091097093/42-amp-Beyond-A-Space-Opera-Anthology-42-amp-Beyond-Series-Volume-4-by-Chandra-Trulove-Fry.pdf