Malicious PDF — malware analysis report

Static analysis result for SHA-256 a17cf243443ca3d3…

MALICIOUS

PDF

18.9 KB Created: 2019-05-04 14:23:45 +01:00 Authoring application: mPDF 5.7
MD5: d540959a3ed67675066330115c7b00bf SHA-1: 16378e4dbf8809b16c82b248c64826c7abc9b775 SHA-256: a17cf243443ca3d3f3bfffaf35d3f2fd59c2b3617e2c658791028286bd4f5519
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, forming a link farm. The primary heuristic indicates this is a PDF SEO link farm, suggesting a tactic to drive traffic to external resources. While the document body is heavily obfuscated, the presence of numerous links points towards a social engineering or redirection-based attack. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7099090096092/Four-Princes-Henry-VIII-Francis-I-Charles-V-Suleiman-the-Magnificent-and-the-Obsessions-that-Forged-Modern-Europe-by-John-Julius-Norwich.pdf
    • http://loaminoo.linkpc.net/2090096093096090/Four-Princes-Henry-VIII-Francis-I-Charles-V-Suleiman-the-Magnificent-and-the-Obsessions-that-Forged-Modern-Europe-by-John-Julius-Norwich.pdf
    • http://loaminoo.linkpc.net/1093098095092092/Byzantium-The-Decline-and-Fall-by-John-Julius-Norwich.pdf
    • http://loaminoo.linkpc.net/1091095096097097090/View-of-the-State-of-Europe-During-the-Middle-Ages-Viii-459-P-by-Henry-Hallam.pdf
    • http://loaminoo.linkpc.net/3093098097095091/Love-Letters-of-Henry-VIII-to-Anne-Boleyn-by-Henry-VIII-of-England.pdf
    • http://loaminoo.linkpc.net/4090093095097093/The-Normans-in-Sicily-The-Normans-in-the-South-1016-1130-and-the-Kingdom-in-the-Sun-1130-1194-by-John-Julius-Norwich.pdf
    • http://loaminoo.linkpc.net/3094094093094094/Darling-Monster-The-Letters-of-Lady-Diana-Cooper-to-her-Son-John-Julius-Norwich-1939-1952-by-Lady-Diana-Cooper.pdf
    • http://loaminoo.linkpc.net/3093099098098092/The-tudor-brief-part1-Henry-VII-and-Henry-VIII-by-Carol-Derbyshire.pdf
    • http://loaminoo.linkpc.net/1094090090096097/The-Last-Wife-of-Henry-VIII-by-Carolly-Erickson.pdf
    • http://loaminoo.linkpc.net/4090090095096092/The-Wives-of-Henry-VIII-by-Antonia-Fraser.pdf
    • http://loaminoo.linkpc.net/1097092099094098/The-Wives-of-Henry-VIII-by-Antonia-Fraser.pdf
    • http://loaminoo.linkpc.net/3094096092096/The-Six-Wives-of-Henry-VIII-by-Alison-Weir.pdf
    • http://loaminoo.linkpc.net/2090095092093092/The-Last-Wife-of-Henry-VIII-by-Carolly-Erickson.pdf
    • http://loaminoo.linkpc.net/2095091099099097/The-Autobiography-Of-Henry-VIII-by-Margaret-George.pdf
    • http://loaminoo.linkpc.net/3093099095096098/Henry-VIII-Man-and-Monarch-by-Susan-Doran.pdf
    • http://loaminoo.linkpc.net/8095097092099091/Henry-VIII-The-Politics-of-Tyranny-by-Jasper-Ridley.pdf
    • http://loaminoo.linkpc.net/4095099095093/Six-Wives-The-Queens-of-Henry-VIII-by-David-Starkey.pdf
    • http://loaminoo.linkpc.net/1091097091093098097/Manga-Shakespeare-Henry-VIII-by-Richard-Appignanesi.pdf
    • http://loaminoo.linkpc.net/9099097096094097/Cage-of-Bones-amp-Other-Deadly-Obsessions-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/3091095090097090/Cage-of-Bones-amp-Other-Deadly-Obsessions-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/30

Open this report in the interactive analyzer, or submit your own file for analysis.