Malicious PDF — malware analysis report

Static analysis result for SHA-256 93db6c145713e855…

MALICIOUS

PDF

16.5 KB Created: 2019-04-30 03:53:52 +01:00 Authoring application: mPDF 5.7
MD5: ce92b5100c1d45d235c42561baad2a7c SHA-1: 47d584c425a3218a3bc69e08ebdf215ff7bf1e12 SHA-256: 93db6c145713e8556e86ba4e4ec1c77b58612b9b8de6e6431bcb07e3ab704934
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to distribute further malware. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5091094096093098/Take-Wing-Poetry-by-David-Allen-Sullivan.pdf
    • http://loaminoo.linkpc.net/9092099091096098/On-the-Wing-by-David-Elliott.pdf
    • http://loaminoo.linkpc.net/1091096094094093090/The-Horten-Flying-Wing-in-World-War-II-by-David-Johnston.pdf
    • http://loaminoo.linkpc.net/5090091097094091/West-Wing-to-Maternity-Wing-by-Scarlet-Wilson.pdf
    • http://loaminoo.linkpc.net/1091092099093095091/Wing-To-Wing-Oar-To-Oar-Readings-on-Courting-and-Marrying-by-Amy-A-Kass.pdf
    • http://loaminoo.linkpc.net/1091093097090098092/David-Wing-And-Ponoka-s-Dakota-District-Pioneers-by-Beverly-Smith-Vorpahl.pdf
    • http://loaminoo.linkpc.net/6090094098099/The-Bomber-by-David-O-39-Sullivan.pdf
    • http://loaminoo.linkpc.net/4096093090095096/Darkthunder-s-Way-David-Sullivan-3-by-Tom-Deitz.pdf
    • http://loaminoo.linkpc.net/4096093090096093/Dreamseeker-s-Road-David-Sullivan-7-by-Tom-Deitz.pdf
    • http://loaminoo.linkpc.net/4096093090095094/Fireshaper-s-Doom-David-Sullivan-2-by-Tom-Deitz.pdf
    • http://loaminoo.linkpc.net/4096093090096099/Warstalker-s-Track-David-Sullivan-9-by-Tom-Deitz.pdf
    • http://loaminoo.linkpc.net/9097097090093/Out-in-the-Dark-Poetry-of-the-First-World-War-in-Context-and-with-Basic-Notes-David-Roberts-by-David---Roberts.pdf
    • http://loaminoo.linkpc.net/3092096093095098/Murder-at-Shady-Oaks-Senior-Estates-The-One-Direction-Massacre-by-David-McMullen-Sullivan.pdf
    • http://loaminoo.linkpc.net/2097095099094090/Always-On-Sunday-An-Inside-View-of-Ed-Sullivan-the-Beatles-Elvis-Sinatra-amp-Ed-s-Other-Guests-by-Michael-David-Harris.pdf
    • http://loaminoo.linkpc.net/9097099099095096/Sullivan-s-Law-Carolyn-Sullivan-1-by-Nancy-Taylor-Rosenberg.pdf
    • http://loaminoo.linkpc.net/1091098092097092/Kabaka-Lear-by-David-Allen.pdf
    • http://loaminoo.linkpc.net/1094096095099097/De-Mayor-of-Harlem-The-Poetry-of-David-Henderson-by-David-Henderson.pdf
    • http://loaminoo.linkpc.net/2096095090095096/Classical-Chinese-Poetry-An-Anthology-by-David-Hinton.pdf
    • http://loaminoo.linkpc.net/1096099092095098/Beautiful-and-Pointless-A-Guide-to-Modern-Poetry-by-David-Orr.pdf
    • http://loaminoo.linkpc.net/3095095097091/Getting-Things-Done-The-Art-of-Stress-Free-Productivity-by-David-Allen.pdf
    • http://loaminoo.linkpc.net/9097097090093/Out-in-the-Dark-Poetry-of-the-First-World-War-in-Context-and-with-Bas

Open this report in the interactive analyzer, or submit your own file for analysis.