Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f6374cccc86bc12…

MALICIOUS

PDF

13.6 KB Created: 2019-04-30 04:53:22 +01:00 Authoring application: mPDF 5.7
MD5: e804569bd1fd8a3b88792de10ea72a79 SHA-1: 1c90947f2c2d04ff2fb7e1b2ecfad608a6cd648a SHA-256: 9f6374cccc86bc12f76632a31795784df9e5d71fa548de71f2c950564ae7eb4f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external websites, identified by the PDF_SEO_LINK_FARM heuristic. While the specific URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to serve as a gateway to further malicious content. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3091094092090099/The-Conquest-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/7097096090090/The-Champion-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/8092091093099/The-Leopard-Unleashed-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/2095091098094092/The-Love-Knot-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/3092094096099094/The-Winter-Mantle-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/2091093090097098/The-Falcons-of-Montabard-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/5097090095098/The-Marsh-King-s-Daughter-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/2091093090093094/The-Marsh-King-s-Daughter-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/3091094094092095/For-the-King-s-Favor-William-Marshal-4-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/8092093099092/The-Scarlet-Lion-William-Marshal-3-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/5096096094099092/A-Rainha-do-Ver-o-Leonor-de-Aquit-nia-1-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/3091094091099098/A-Place-Beyond-Courage-William-Marshal-1-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/2099096093094096/The-Greatest-Knight-William-Marshal-2-by-Elizabeth-Chadwick.pdf
    • http://loaminoo.linkpc.net/3097090096091097/Wives-and-Daughters-by-Elizabeth-Gaskell.pdf
    • http://loaminoo.linkpc.net/6095099099094090/Wives-and-Daughters-by-Elizabeth-Gaskell.pdf
    • http://loaminoo.linkpc.net/2095090097094095/Wives-and-Daughters-by-Elizabeth-Gaskell.pdf
    • http://loaminoo.linkpc.net/8094092099092/Wives-and-Daughters-by-Elizabeth-Gaskell.pdf
    • http://loaminoo.linkpc.net/4091090094090099/Wives-and-Daughters-by-Elizabeth-Gaskell.pdf
    • http://loaminoo.linkpc.net/5090090099097099/Things-I-Want-My-Daughters-To-Know-by-Elizabeth-Noble.pdf
    • http://loaminoo.linkpc.net/6095098092097094/Wives-and-Daughters-by-Elizabeth-Gaskell.pdf
    • http://loaminoo.linkpc.net/30

Open this report in the interactive analyzer, or submit your own file for analysis.