Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b95020b1d198cbd…

MALICIOUS

PDF

15.0 KB Created: 2020-03-15 00:53:13 +00:00 Authoring application: mPDF 5.7
MD5: ec9114bb8d3dfb57e890f8eb0ac3031b SHA-1: 4f7c67344db68309765d5f5e7a626760664a68eb SHA-256: 8b95020b1d198cbd0a136add86b6745b3ece73fe780811ca1f307fec279c97b7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to external book download pages, suggesting a link farm or SEO spam campaign. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/281608168816981678169/Dreams-of-a-Dark-Warrior-Immortals-After-Dark-11-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/281638164816581658165/Dark-Needs-at-Night-s-Edge-Immortals-After-Dark-5-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/381618167816481698162/Dark-Needs-at-Night-s-Edge-Immortals-After-Dark-5-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/281668167816781668165/Dark-Needs-at-Night-s-Edge-Immortals-After-Dark-5-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/481688165816381688165/Dark-Desires-After-Dusk-Immortals-After-Dark-6-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/181698164816981638169/Lothaire-Immortals-After-Dark-12-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/381668169816281618161/Lothaire-Immortals-After-Dark-12-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/481648165816481638163/A-Hunger-Like-No-Other-Immortals-After-Dark-2-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/181648168816081618163/Untouchable-Immortals-After-Dark-8-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/18161816581678168/Lothaire-Immortals-After-Dark-12-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/281608168816981688162/Lothaire-Immortals-After-Dark-12-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/48166816381668165/The-Warlord-Wants-Forever-Immortals-After-Dark-1-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/481688168816581628165/The-Warlord-Wants-Forever-Immortals-After-Dark-1-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/381668169816581688167/No-Rest-for-the-Wicked-Immortals-After-Dark-3-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/181648167816881628167/Sweet-Ruin-Immortals-After-Dark-16-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/281668167816681648162/The-Warlord-Wants-Forever-Immortals-After-Dark-1-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/881668168816481648164/Verf-hrung-der-Schatten-Immortals-After-Dark-6-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/381648161816281618160/Sweet-Ruin-Immortals-After-Dark-16-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/881618167816881638166/Karanl-ktan-Gelen-blis-Immortals-After-Dark-10-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhome.cx/18160816981698160/Shadow-s-Claim-Immortals-After-Dark-13-The-Dacians-1-by-Kresley-Cole.pdf
    • http://owlaokopdf.myhom

Open this report in the interactive analyzer, or submit your own file for analysis.