Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f0c527837e58ec0…

MALICIOUS

PDF

17.1 KB Created: 2019-04-29 23:32:46 +01:00 Authoring application: mPDF 5.7
MD5: 23b3c62636b6b3ee18599704ef211ac2 SHA-1: 232f8d8cbc6a9cad95fae27543028acdd87bcbc9 SHA-256: 8f0c527837e58ec07718b19accec4f7a6a42ca06c54ff1c84bdb6377ae353e0a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier as malicious. It contains a large number of embedded links, identified as a PDF SEO link farm. While the specific URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, likely to direct users to harmful content or for SEO poisoning. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9092095097092098/Assignment-Cyprus-Middle-East-Mission-by-Trooper.pdf
    • http://loaminoo.linkpc.net/9092095097092091/Assignment-Cyprus-by-Trooper.pdf
    • http://loaminoo.linkpc.net/5098098096095090/Prophetic-Voices-on-Middle-East-Peace-A-Jewish-Christian-and-Humanist-Primer-on-Colonialism-Zionism-amp-Nationalism-in-the-Middle-East-by-Thomas-E-Phillips.pdf
    • http://loaminoo.linkpc.net/9092095097092096/The-Golden-Kris-S-A-S-Malaya-Mission-by-Trooper.pdf
    • http://loaminoo.linkpc.net/6090099094097096/The-Civilizations-of-the-East-Near-and-Middle-East-by-Ren-Grousset.pdf
    • http://loaminoo.linkpc.net/2093099091099098/Looking-East-To-Look-West-Lee-Kuan-Yew-s-Mission-India-by-Sunanda-K-Datta-Ray.pdf
    • http://loaminoo.linkpc.net/8092098090093093/The-Civilising-Mission-and-the-English-Middle-Class-1792-1850-by-Twells-A.pdf
    • http://loaminoo.linkpc.net/4093097090093091/Licensed-to-Spy-With-the-Top-Secret-Military-Liaison-Mission-to-East-Germany-by-John-A-Fahey.pdf
    • http://loaminoo.linkpc.net/8096090097096092/A-Concise-History-of-the-Middle-East-by-Arthur-Goldschmidt-Jr-.pdf
    • http://loaminoo.linkpc.net/6091093096094098/The-Multiple-Identities-of-the-Middle-East-by-Bernard-Lewis.pdf
    • http://loaminoo.linkpc.net/9091093097098/The-Middle-East-Bedside-Book-by-Tahir-Shah.pdf
    • http://loaminoo.linkpc.net/1091098090094099092/Middle-East-War-Imperialism-and-Ecology-by-Roland-Rance.pdf
    • http://loaminoo.linkpc.net/3098094091091090/America-s-War-for-the-Greater-Middle-East-by-Andrew-J-Bacevich.pdf
    • http://loaminoo.linkpc.net/7099097095092094/Beyond-Terror-and-Martyrdom-The-Future-of-the-Middle-East-by-Gilles-Kepel.pdf
    • http://loaminoo.linkpc.net/2090098090091099/19-Varieties-of-Gazelle-Poems-of-the-Middle-East-by-Naomi-Shihab-Nye.pdf
    • http://loaminoo.linkpc.net/3097095097094095/Six-Days-How-the-1967-War-Shaped-the-Middle-East-by-Jeremy-Bowen.pdf
    • http://loaminoo.linkpc.net/1095094095094096/The-Next-Founders-Voices-of-Democracy-in-the-Middle-East-by-Joshua-Muravchik.pdf
    • http://loaminoo.linkpc.net/5099097092093090/From-Babel-to-Dragomans-Interpreting-the-Middle-East-by-Bernard-Lewis.pdf
    • http://loaminoo.linkpc.net/1098094091097090/Children-in-the-Muslim-Middle-East-by-Elizabeth-Warnock-Fernea.pdf
    • http://loaminoo.linkpc.net/1094099097094/19-Varieties-of-Gazelle-Poems-of-the-Middle-East-by-Naomi-Shihab-Nye.pdf
    • http://loaminoo.linkpc.net/4093097090093091/Licensed-to-Spy-With

Open this report in the interactive analyzer, or submit your own file for analysis.