Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2dddf0582c94f6f…

MALICIOUS

PDF

15.3 KB Created: 2019-04-30 03:41:07 +01:00 Authoring application: mPDF 5.7
MD5: aec165285dda79346f93592717a68c4a SHA-1: d55e247096d7c2ee710446803f9793413f538eda SHA-256: a2dddf0582c94f6fdb0c5989ab56473145de9ac0d740e39fb32a7dbc4da7ac71
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded URLs, identified as a link farm. The ML classifier strongly indicated maliciousness. The primary attack pattern appears to be SEO poisoning or directing users to potentially malicious content via a large number of links. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of specific user lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8096094097090/Swing-Landry-Family-2-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/4095090096093099/Swing-Landry-Family-2-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/2096095095098097/Switch-Landry-Family-3-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/8094095096099/Swear-Landry-Family-4-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/5091093095/Switch-Landry-Family-3-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/7097095096097097/Dave-Landry-on-Swing-Trading-by-David-Landry.pdf
    • http://loaminoo.linkpc.net/2096098099/Wherever-It-Leads-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/4093091097/Written-in-the-Scars-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/8094098091095/Battle-of-the-Sexes-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/6095094096095096/The-Perception-The-Exception-2-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/8095098096091/The-Perception-The-Exception-2-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/6095094096098092/The-Connection-The-Exception-1-5-by-Adriana-Locke.pdf
    • http://loaminoo.linkpc.net/7097095095093095/Landry-s-Law-Landry-Brothers-2-by-Kelsey-Roberts.pdf
    • http://loaminoo.linkpc.net/1090095093096091099/Hank-Haney-s-Essentials-of-the-Swing-A-7-Point-Plan-for-Building-a-Better-Swing-and-Shaping-Your-Shots-by-Hank-Haney.pdf
    • http://loaminoo.linkpc.net/7097095097097092/Mocha-Cake-and-Murder-A-Libby-Landry-Mystery-Libby-Landry-Mystery-Series-Book-1-by-Angelica-Willow.pdf
    • http://loaminoo.linkpc.net/1091092092094099099/The-Correspondence-of-John-Locke-3-Letters-849-1241-1686-89-by-John-Locke.pdf
    • http://loaminoo.linkpc.net/4095091094090099/Room-to-Swing-by-Ed-Lacy.pdf
    • http://loaminoo.linkpc.net/4097092093098096/Swing-Low-by-Miriam-Toews.pdf
    • http://loaminoo.linkpc.net/4099093094096092/Swing-Zone-by-Jodi-McClure.pdf
    • http://loaminoo.linkpc.net/4090097097098090/The-Girl-in-a-Swing-by-Richard-Adams.pdf
    • http://loaminoo.linkpc.net/1090095093096091099/Hank-Han

Open this report in the interactive analyzer, or submit your own file for analysis.