Malicious PDF — malware analysis report

Static analysis result for SHA-256 988575d930130944…

MALICIOUS

PDF

13.4 KB Created: 2019-05-03 05:07:37 +01:00 Authoring application: mPDF 5.7
MD5: fc844384e3999904f3e23ce8e8830073 SHA-1: 7ec55217408f13728b516e212bae2429dd0c6f78 SHA-256: 988575d930130944e1cb3b3371d59490cc297d3dc6736bb644e71478cfdb1889
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent, likely for SEO manipulation or to serve as a distribution point for further malware. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3095090096091097/In-the-Shadow-s-Light-by-Yves-Bonnefoy.pdf
    • http://loaminoo.linkpc.net/8092091090098096/Bonnefoy-s-Select-by-Yves-Bonnefoy.pdf
    • http://loaminoo.linkpc.net/8092091092092098/The-Present-Hour-by-Yves-Bonnefoy.pdf
    • http://loaminoo.linkpc.net/1096095093091094/Selected-Poems-by-Yves-Bonnefoy.pdf
    • http://loaminoo.linkpc.net/6094093097092096/Alberto-and-Diego-Giacometti-by-Yves-Bonnefoy.pdf
    • http://loaminoo.linkpc.net/8092091091092094/Greek-and-Egyptian-Mythologies-by-Yves-Bonnefoy.pdf
    • http://loaminoo.linkpc.net/8092091093095092/L-charpe-rouge-Deux-sc-nes-et-notes-jointes-by-Yves-Bonnefoy.pdf
    • http://loaminoo.linkpc.net/3098099097090097/Grand-Conspiracy-Wars-of-Light-amp-Shadow-5-Arc-3---Alliance-of-Light-2-by-Janny-Wurts.pdf
    • http://loaminoo.linkpc.net/1093092097094090/Peril-s-Gate-Wars-of-Light-and-Shadow-6-Arc-3---Alliance-of-Light-3-by-Janny-Wurts.pdf
    • http://loaminoo.linkpc.net/9094098098090092/Shadow-of-the-Wolf-Agaguk-by-Yves-Th-riault.pdf
    • http://loaminoo.linkpc.net/2093099097096094/The-Shadow-and-the-Light-by-S-K-Michels.pdf
    • http://loaminoo.linkpc.net/4092095090090091/A-Shadow-All-of-Light-by-Fred-Chappell.pdf
    • http://loaminoo.linkpc.net/2092099091090092/Nocturne-Light-and-Shadow-3-by-A-D-Truax.pdf
    • http://loaminoo.linkpc.net/2095095094091/Light-and-Shadow-by-Lisa-Gregory.pdf
    • http://loaminoo.linkpc.net/2092099091090098/Skiagraphia-Light-and-Shadow-4-by-A-D-Truax.pdf
    • http://loaminoo.linkpc.net/1098099096091094/Shadow-s-Light-Kindred-6-by-Nicola-Claire.pdf
    • http://loaminoo.linkpc.net/7099097096097/Light-in-Shadow-Whispering-Springs-1-by-Jayne-Ann-Krentz.pdf
    • http://loaminoo.linkpc.net/2093092092093098/Destiny-of-the-Light-Shadow-Through-Time-1-by-Louise-Cusack.pdf
    • http://loaminoo.linkpc.net/1099096097095098/The-Curse-of-the-Mistwraith-Wars-of-Light-amp-Shadow-1-Arc-1-1-by-Janny-Wurts.pdf
    • http://loaminoo.linkpc.net/4093091095096093/Shadow-Fire-Light-Chronicles-1-by-Kimber-Leigh-Wheaton.pdf
    • http://loaminoo.linkpc.net/2095095094091/Light-and-Sha

Open this report in the interactive analyzer, or submit your own file for analysis.