Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a9f601a778abc17…

MALICIOUS

PDF

17.4 KB Created: 2019-05-07 02:59:46 +01:00 Authoring application: mPDF 5.7
MD5: 3334aa63bbbe8d5f0926912c4fa70820 SHA-1: d17f8df65caadec691246d02847df0643bb23187 SHA-256: 9a9f601a778abc177595df52c44f89c8ee05cd0cd1234f36af4cab1a350c33ce
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. While the specific intent beyond linking is unclear due to the lack of executable scripts, the sheer volume of links suggests a malicious distribution or redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3093098099096093/Watch-the-Lady-The-Tudor-Trilogy-3-by-Elizabeth-Fremantle.pdf
    • http://loaminoo.linkpc.net/3095091097097099/The-Poison-Bed-by-Elizabeth-Fremantle.pdf
    • http://loaminoo.linkpc.net/2095099092098091/Queen-s-Gambit-by-Elizabeth-Fremantle.pdf
    • http://loaminoo.linkpc.net/4099096097096091/The-Girl-in-the-Glass-Tower-by-Elizabeth-Fremantle.pdf
    • http://loaminoo.linkpc.net/2095096092093098/The-Temptation-of-Elizabeth-Tudor-Elizabeth-I-Thomas-Seymour-and-the-Making-of-a-Virgin-Queen-by-Elizabeth-Norton.pdf
    • http://loaminoo.linkpc.net/1099098091097094/Lady-Be-Good-American-s-Lady-2-by-Susan-Elizabeth-Phillips.pdf
    • http://loaminoo.linkpc.net/4095095093097097/Lady-Merry-s-Dashing-Champion-Lady-Trilogy-3-by-Jeane-Westin.pdf
    • http://loaminoo.linkpc.net/3093099092094093/Fifty-Shades-of-Lady-Catherine-Grey-The-Sex-Scandals-that-Shook-the-Tudor-Court-by-T-S-Wiseman.pdf
    • http://loaminoo.linkpc.net/3094090091094097/Elizabeth-of-York-The-Forgotten-Tudor-Queen-by-Amy-Licence.pdf
    • http://loaminoo.linkpc.net/2097094092090092/The-Sisters-Who-Would-Be-Queen-Mary-Katherine-and-Lady-Jane-Grey-A-Tudor-Tragedy-by-Leanda-de-Lisle.pdf
    • http://loaminoo.linkpc.net/2095096096095096/The-Watch-Tower-by-Elizabeth-Harrower.pdf
    • http://loaminoo.linkpc.net/1095091092095092/Wolf-Bride-Lust-in-the-Tudor-Court-1-by-Elizabeth-Moss.pdf
    • http://loaminoo.linkpc.net/4094092094090093/Rose-Bride-Lust-in-the-Tudor-Court-3-by-Elizabeth-Moss.pdf
    • http://loaminoo.linkpc.net/3093099095098091/Elizabeth-the-Queen-The-Lady-Elizabeth-by-Alison-Weir.pdf
    • http://loaminoo.linkpc.net/1092095093096094/Witchfall-The-Tudor-Witch-Trilogy-2-by-Victoria-Lamb.pdf
    • http://loaminoo.linkpc.net/3093099095098090/Jasper---Book-Two-of-The-Tudor-Trilogy-by-Tony-Riches.pdf
    • http://loaminoo.linkpc.net/2098095097098096/Elizabeth-I-Red-Rose-of-the-House-of-Tudor-England-1544-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/3093099092092092/The-Hidden-Lives-of-Tudor-Women-A-Social-History-by-Elizabeth-Norton.pdf
    • http://loaminoo.linkpc.net/3093099092092094/Plantagenet-Princess-Tudor-Queen-The-Story-of-Elizabeth-of-York-by-Samantha-Wilcoxson.pdf
    • http://loaminoo.linkpc.net/3093098092/End-of-Watch-Bill-Hodges-Trilogy-3-by-Stephen-King.pdf
    • http://loaminoo.linkpc.net/3093099092094093/Fifty-Shades-of-Lady-Catherine-Grey-T

Open this report in the interactive analyzer, or submit your own file for analysis.