Malicious PDF — malware analysis report

Static analysis result for SHA-256 97ce59aac4329e01…

MALICIOUS

PDF

18.0 KB Created: 2019-05-03 02:33:31 +01:00 Authoring application: mPDF 5.7
MD5: 9ab4571c6636892a7f59ddfeada90daa SHA-1: 1716a49afc20e451573b449662f15c7b4b70d408 SHA-256: 97ce59aac4329e017642345b1565fa66268b00193fc4d99f566d6c85641a43f8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, forming a link farm. The heuristic PDF_SEO_LINK_FARM indicates that these are likely SEO-optimized links pointing to external PDF documents. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be directing users to a large collection of external content, potentially for SEO manipulation or to host malicious payloads disguised as legitimate documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3097099096097097/The-Hockey-Play-Book-Teaching-Hockey-Systems-by-Michael-A-Smith.pdf
    • http://loaminoo.linkpc.net/4093092097091092/The-Hockey-Player-s-Heart-Hockey-Hearts-1-by-Jeff-Adams.pdf
    • http://loaminoo.linkpc.net/7099097097091098/Labo-Hockey-25-Exp-riences-de-Hockey-by-Leslie-Johnstone.pdf
    • http://loaminoo.linkpc.net/8094091098093090/Sons-and-Lovers-1913-Novel-by-D-H-Lawrence-100-Best-Novels-of-the-20th-Century-Include-Women-in-Love-1920-Novel-By-D-H-Lawrence-by-D-H-Lawrence.pdf
    • http://loaminoo.linkpc.net/2095093096090090/The-Fart-Party-Vol-1-by-Julia-Wertz.pdf
    • http://loaminoo.linkpc.net/8094092095098/The-Art-of-Fart-The-Joy-of-Flatulence-by-Dougie-Brimson.pdf
    • http://loaminoo.linkpc.net/9099094096094093/FART-JOKES-FOR-THE-AGES-by-Jeffrey-Jeschke.pdf
    • http://loaminoo.linkpc.net/9092093094099098/Fart-Squad-4-The-Toilet-Vortex-by-Seamus-Pilger.pdf
    • http://loaminoo.linkpc.net/9092093096091093/Fart-Squad-6-Blast-from-the-Past-by-Seamus-Pilger.pdf
    • http://loaminoo.linkpc.net/7097093094094092/Does-It-Fart-The-Definitive-Field-Guide-to-Animal-Flatulence-by-Nick-Caruso.pdf
    • http://loaminoo.linkpc.net/4093092094095093/The-Golden-Warrior-The-Life-and-Legend-of-Lawrence-of-Arabia-by-Lawrence-James.pdf
    • http://loaminoo.linkpc.net/1090093099090092098/THE-PLUMED-SERPENT-by-D-H-Lawrence-author-of-Sons-and-Lovers-The-Rainbow-Women-in-Love-and-Lady-Chatterley-s-Lover-Annotated-by-D-H-Lawrence.pdf
    • http://loaminoo.linkpc.net/9099094092094093/The-Fantastic-Flatulent-Fart-Brothers-Save-the-World-A-Comedy-Thriller-Adventure-that-Truly-Stinks-US-edition-by-M-D-Whalen.pdf
    • http://loaminoo.linkpc.net/1091092091096092097/The-Works-of-D-H-Lawrence-by-D-H-Lawrence.pdf
    • http://loaminoo.linkpc.net/3091092096092097/D-H-Lawrence-and-Italy-by-D-H-Lawrence.pdf
    • http://loaminoo.linkpc.net/1090094093095090091/Doctor-Proctor-s-Fart-Powder-The-Great-Gold-Robbery-Doctor-Proctor-4-by-Jo-Nesb-.pdf
    • http://loaminoo.linkpc.net/4098092092094098/Hockey-Wives-Box-Set-by-S-M-Kingdom.pdf
    • http://loaminoo.linkpc.net/6098092092095096/The-Hockey-Princess-by-Francois-M-Plouffe.pdf
    • http://loaminoo.linkpc.net/3094091095098095/I-Hate-Hockey-by-Fran-ois-Barcelo.pdf
    • http://loaminoo.linkpc.net/4098092092094094/Hockey-Wives-Face-Off-by-S-M-Kingdom.pdf
    • http://loaminoo.linkpc.net

Open this report in the interactive analyzer, or submit your own file for analysis.