Malicious PDF — malware analysis report

Static analysis result for SHA-256 8bbdbdd398a02862…

MALICIOUS

PDF

16.5 KB Created: 2019-04-30 08:29:12 +01:00 Authoring application: mPDF 5.7
MD5: c8a560ebc8cf159c59fb4a77bd581eff SHA-1: 428a9f946e442cef5be1e81d676666d86a6c47a6 SHA-256: 8bbdbdd398a02862594b8ee0fc873f3af616bf6e9a32e7a8c66e4ff555240e27
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or distribution mechanism. The ML_NYX_PDF_MALICIOUS heuristic also flagged the file with high confidence. While the document body is heavily corrupted, the presence of numerous URLs points towards a malicious intent, likely to redirect users to compromised sites or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4092093092091/Code-Name-Verity-Code-Name-Verity-1-by-Elizabeth-E-Wein.pdf
    • http://loaminoo.linkpc.net/3098097090093099/Code-Name-Verity-Code-Name-Verity-1-by-Elizabeth-E-Wein.pdf
    • http://loaminoo.linkpc.net/3090097092093/Code-Name-Verity-by-Elizabeth-E-Wein.pdf
    • http://loaminoo.linkpc.net/2092092096091091/Rose-Under-Fire-Code-Name-Verity-2-by-Elizabeth-E-Wein.pdf
    • http://loaminoo.linkpc.net/5096097098/The-Pearl-Thief-Code-Name-Verity-0-5-by-Elizabeth-E-Wein.pdf
    • http://loaminoo.linkpc.net/2092090099091091/Rose-Under-Fire-Code-Name-Verity-2-by-Elizabeth-E-Wein.pdf
    • http://loaminoo.linkpc.net/6096091094/Code-Girls-The-Untold-Story-of-the-American-Women-Code-Breakers-Who-Helped-Win-World-War-II-by-Liza-Mundy.pdf
    • http://loaminoo.linkpc.net/1098091095094092/Code-Name-Nanny-SEAL-and-Code-Name-5-by-Christina-Skye.pdf
    • http://loaminoo.linkpc.net/3098093090094092/The-Friendship-Code-Girls-Who-Code-1-by-Stacia-Deutsch.pdf
    • http://loaminoo.linkpc.net/3099096090096097/Code-Name-Bundle-Includes-Code-Name-3-5-by-Christina-Skye.pdf
    • http://loaminoo.linkpc.net/8094095098097/Code-Name-Baby-SEAL-and-Code-Name-7-by-Christina-Skye.pdf
    • http://loaminoo.linkpc.net/9095099091096093/A-Code-Of-Love-Code-Breakers-1-by-Jacki-Delecki.pdf
    • http://loaminoo.linkpc.net/1091095092098095094/The-Code-Red-Revolution-How-Thousands-of-People-are-Losing-Weight-and-Keeping-it-Off-WITHOUT-Pills-Shakes-Diet-Foods-or-Exercise-by-Cristy-Code-Red-Nickel.pdf
    • http://loaminoo.linkpc.net/1092095097095097/The-Bar-Code-Prophecy-Bar-Code-3-by-Suzanne-Weyn.pdf
    • http://loaminoo.linkpc.net/1099091099090092/May-Day-Mine-by-Verity-Croker.pdf
    • http://loaminoo.linkpc.net/2091096095093099/The-Davina-Code-by-Janet-Elizabeth-Henderson.pdf
    • http://loaminoo.linkpc.net/2092097096092098/Verity-Fire-by-Nishit-Rathod.pdf
    • http://loaminoo.linkpc.net/4093094094095095/A-Slave-For-The-Demon-1-by-Verity-Vixxen.pdf
    • http://loaminoo.linkpc.net/4091094090091091/The-Leader-Code-Crack-this-once-hidden-code-to-become-an-effective-leader-by-Dan-Blakeslee.pdf
    • http://loaminoo.linkpc.net/3091094099095099/Verity-Mullens-and-the-Indian-by-Natalia-Belting.pdf
    • http://loaminoo.linkpc.net/3099096090096097/Code-Name-

Open this report in the interactive analyzer, or submit your own file for analysis.