Malicious PDF — malware analysis report

Static analysis result for SHA-256 9aa48c37fd86be23…

MALICIOUS

PDF

13.4 KB Created: 2019-04-30 10:25:25 +01:00 Authoring application: mPDF 5.7
MD5: d5e24a47ed3ed6cbf023b4ab4a96c2ad SHA-1: 9de80b2baa773838c46704b71c9f1667df9ad061 SHA-256: 9aa48c37fd86be2345e2f0d539ef8f3c7c315a5acb9967c5341536366a32207e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier as malicious. It contains a large number of embedded URLs, identified as a link farm, which is a common technique for SEO manipulation or distributing further malicious content. While the specific intent of these links is unclear, the sheer volume and the ML classification suggest a malicious purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/2209206209206205/The-Sea-Breeze-Collection-Breathe-Because-of-Low-While-It-Lasts-Just-for-Now-Sea-Breeze-1-4-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/1204205205202207/Until-the-End-Sea-Breeze-9-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4200208202203/Bad-for-You-Sea-Breeze-7-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4200204208201202/Just-for-Now-Sea-Breeze-4-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/5203200207201/Bad-for-You-Sea-Breeze-7-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6207200201206/Just-for-Now-Sea-Breeze-4-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6208203205202/Sometimes-It-Lasts-Sea-Breeze-5-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6203204207209/Misbehaving-Sea-Breeze-6-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4209200206207206/Breathe-Sea-Breeze-1-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4201201201205204/Breathe-Sea-Breeze-1-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/5208206206204/While-It-Lasts-Sea-Breeze-3-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4201209200204/Hold-on-Tight-Sea-Breeze-8-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/9203201203201208/Never-Too-Far-Too-Far-2-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6201200209202/Until-the-End-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6204201204209202/Take-a-chance-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/3202202201207201/Fallen-Too-Far-Too-Far-1-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4209203201205208/You-Were-Mine-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/9203201203201206/Fallen-Too-Far-Too-Far-1-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/3203204208205/Never-Too-Far-Rosemary-Beach-2-Too-Far-2-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/3203202203207/Until-Friday-Night-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/92032

Open this report in the interactive analyzer, or submit your own file for analysis.