Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a9f013d1d42af00…

MALICIOUS

PDF

15.0 KB Created: 2019-05-02 17:30:53 +01:00 Authoring application: mPDF 5.7
MD5: 22d4deda6e45db6b8025be157fd99111 SHA-1: 2a5755b7ff6c94e9d869d1a8538d9a7ab75e34f2 SHA-256: 8a9f013d1d42af003bd7b9eca70d47b7a97bbabd48b9bcb15b3248013df47b4e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various book titles hosted on loaminoo.linkpc.net. While these specific URLs were flagged as benign, the sheer volume and the nature of the heuristic suggest a link farm or SEO manipulation tactic, which can be a precursor to distributing malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8096094093091091/The-Call-of-the-Wild-and-White-Fang-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/6090099096099093/The-Call-of-the-Wild-Includes-MLA-Style-Citations-for-Scholarly-Secondary-Sources-Peer-Reviewed-Journal-Articles-and-Critical-Essays-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/2097096093097098/Best-Short-Stories-of-Jack-London-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/2092092092096098/The-Unabridged-Jack-London-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/4090096092090095/The-Story-Of-Wild-Goose-Jack-The-Life-And-Work-Of-Jack-Miner-by-James-M-Linton.pdf
    • http://loaminoo.linkpc.net/4099097096096092/The-Wild-Ones-The-Wild-Ones-1-by-C-Alexander-London.pdf
    • http://loaminoo.linkpc.net/4097094097096091/Call-Me-Joker-s-Wild-1-by-Lena-Matthews.pdf
    • http://loaminoo.linkpc.net/1091092095095093092/The-Call-of-the-Wild-Graphic-Novels-by-Neil-Kleid.pdf
    • http://loaminoo.linkpc.net/8094096098096095/The-Call-of-the-Wild-A-Naturalistic-Romance-by-Jacqueline-Tavernier-Courbin.pdf
    • http://loaminoo.linkpc.net/3093091098095093/Last-Call-Jack-Swyteck-7-by-James-Grippando.pdf
    • http://loaminoo.linkpc.net/3094098091097/The-Sea-Wolf-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/1092092092097098/The-Sea-Wolf-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/3097090096092093/The-Sea-Wolf-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/1090098095093095093/Call-of-the-Wild-amp-Other-Stories-Oper-Intro-Grade-by-Ellen-O-39-Connor.pdf
    • http://loaminoo.linkpc.net/3093092092093091/George-R-R-Martin-s-Wild-Cards-The-Hard-Call-by-Daniel-Abraham.pdf
    • http://loaminoo.linkpc.net/7092091099090/The-Dark-One-Wild-Wulfs-of-London-1-by-Ronda-Thompson.pdf
    • http://loaminoo.linkpc.net/1092091099092092/The-Cursed-One-Wild-Wulfs-of-London-3-by-Ronda-Thompson.pdf
    • http://loaminoo.linkpc.net/4097094096099097/Love-of-Life-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/1091095095094093096/White-Fang-by-Jack-London.pdf
    • http://loaminoo.linkpc.net/5092094096091098/White-Fang-by-Jack-London.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.