Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3843c2604cac5cf…

MALICIOUS

PDF

18.2 KB Created: 2019-05-07 03:46:31 +01:00 Authoring application: mPDF 5.7
MD5: 35e2bb5db8476873552b40e0b985e7e7 SHA-1: 1191a217a41c09933b1cfb538294f81355e29962 SHA-256: a3843c2604cac5cf2436a4db8035ba23c07793bb40bbdc7f5a091bbadb336144
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified as a link farm. The ML classifier strongly suggests maliciousness, and the PDF_SEO_LINK_FARM heuristic indicates the file's purpose is to direct users to a multitude of external PDF documents. While the specific intent of these linked PDFs is unclear, the sheer volume and the heuristic's classification point towards a malicious SEO poisoning or content hosting strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090094099094098090/HOLLY-BLACK-SERIES-READING-ORDER-MAGISTERIUM-BOOKS-MODERN-TALE-OF-FAERIE-BOOKS-SPIDERWICK-CHRONICLES-BOOKS-BEYONG-SPIDERWICK-CHRONICLES-GOOD-NEIGHBORS-BOOKS-BY-HOLLY-BLACK-by-List-Series.pdf
    • http://loaminoo.linkpc.net/1091099096090090/Darkest-Flame-Part-1-by-Donna-Grant.pdf
    • http://loaminoo.linkpc.net/9096091095090/The-Darkest-Part-of-the-Woods-by-Ramsey-Campbell.pdf
    • http://loaminoo.linkpc.net/6098099095098/Black-Heart-Curse-Workers-3-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/8096099098091/Warrior-Cats-Collection-The-Darkest-Hour-A-Dangerous-Path-Rising-Storm-Forest-Of-Secrets-Fire-And-Ice-Warriors-2-6-by-Erin-Hunter.pdf
    • http://loaminoo.linkpc.net/3093099099099091/New-Beginnings-at-the-Star-and-Sixpence-Part-One-in-the-new-series-by-Holly-Hepburn.pdf
    • http://loaminoo.linkpc.net/3095094094091097/Black-Crown-The-Darkest-Drae-Book-3-by-Raye-Wagner.pdf
    • http://loaminoo.linkpc.net/3099098099099096/Meanwhile-In-Another-Part-Of-The-Forest-Gay-Stories-from-Alice-Munro-to-Yukio-Mishima-by-Alberto-Manguel.pdf
    • http://loaminoo.linkpc.net/1091098096090096/Black-Forest-by-David-Thayer.pdf
    • http://loaminoo.linkpc.net/3098091090/The-Bronze-Key-Magisterium-3-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/2096097090099/Zombies-Vs-Unicorns-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/1093095091092098/The-Copper-Gauntlet-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/2091098090090093/Doll-Bones-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/5098091097090095/2-Magisterium-Le-gant-de-cuivre-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/1096092096/The-Copper-Gauntlet-Magisterium-2-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/9092091092098097/Okrutny-ksi-The-Folk-of-the-Air-1-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/4092090097090091/The-Copper-Gauntlet-Magisterium-2-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/2091094092091096/The-Coldest-Girl-in-Coldtown-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/8097099092/The-Golden-Tower-Magisterium-5-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/3097094097093092/Kind-The-Good-Neighbors-3-by-Holly-Black.pdf
    • http://loaminoo.linkpc.net/8096099098091

Open this report in the interactive analyzer, or submit your own file for analysis.