Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5922c4c4d4d96c9…

MALICIOUS

PDF

15.5 KB Created: 2019-05-02 05:10:44 +01:00 Authoring application: mPDF 5.7
MD5: 14048a740dad5eb65e4f4fa5207fe9da SHA-1: 5a7a5cf47304a07b5a662f70c339ad024fd83f90 SHA-256: a5922c4c4d4d96c98ea8def4de8a8310a9ddda1ae9f112c82226fdc3baf46b16
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the specific URLs appear to be benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to distribute further payloads. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.n
    • http://loaminoo.linkpc.net/1091099097095099091/Reckoning-of-Dragons-Dragon-Killer-Roll-the-Bones-amp-Sirensbane-by-Rob-May.pdf
    • http://loaminoo.linkpc.net/4094096093091099/Dragon-Killer-Reckoning-of-Dragons-1-by-Rob-May.pdf
    • http://loaminoo.linkpc.net/1097092095093092/The-Rain-Wilds-Chronicles-Dragon-Keeper-Dragon-Haven-City-of-Dragons-and-Blood-of-Dragons-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/2094096095095/Gonna-Roll-the-Bones-by-Fritz-Leiber.pdf
    • http://loaminoo.linkpc.net/3094091095097094/The-Concert-Killer-Rock-amp-Roll-Mystery-Series-by-R-J-McDonnell.pdf
    • http://loaminoo.linkpc.net/3097094092096092/A-Tale-of-Two-Dragons-Dragon-Kin-0-2-by-G-A-Aiken.pdf
    • http://loaminoo.linkpc.net/7099093094098093/Dragon-s-Bones-Stonefort-3-by-James-A-Hetley.pdf
    • http://loaminoo.linkpc.net/4099096097090091/Dragon-Rebirth-Dragons-in-the-Mist-2-by-B-J-Whittington.pdf
    • http://loaminoo.linkpc.net/5098097099097090/A-Mate-for-the-Dragon-Lost-Dragons-1-by-Zoe-Chant.pdf
    • http://loaminoo.linkpc.net/2093095099090094/Dragon-s-Blood-Pit-Dragons-1-by-Jane-Yolen.pdf
    • http://loaminoo.linkpc.net/2099095094092090/Dragon-Song-Dragons-and-Visions-2-by-Jim-Murdoch.pdf
    • http://loaminoo.linkpc.net/2098093097096091/Dragon-Bones-Nia-Rivers-Adventures-1-by-Jasmine-Walt.pdf
    • http://loaminoo.linkpc.net/6093096098091096/Fume-Dragon-Dragons-of-Cadia-2-by-Amelia-Jade.pdf
    • http://loaminoo.linkpc.net/3092097093094095/Dragon-s-Lair-Wind-Dragons-MC-1-by-Chantal-Fernando.pdf
    • http://loaminoo.linkpc.net/7094094091091/Dragon-s-Lair-Wind-Dragons-MC-1-by-Chantal-Fernando.pdf
    • http://loaminoo.linkpc.net/6093099094091090/Dragon-s-Domain-Dragons-Series-4-by-Thorarinn-Gunnarsson.pdf
    • http://loaminoo.linkpc.net/4099096093098092/A-Host-of-Dragons-Dragon-Delasangre-4-by-Alan-F-Troop.pdf
    • http://loaminoo.linkpc.net/3097098093092097/For-A-Dragon-s-Touch-Highland-Dragons-1-by-Charlie-Richards.pdf
    • http://loaminoo.linkpc.net/2090096092095091/Sacrificed-to-the-Dragon-Stonefire-Dragons-1-by-Jessie-Donovan.pdf
    • http://loaminoo.linkpc.net/4093094098093097/Dragon-s-Blood-Cruentus-Dragons-1-by-Brynn-Paulin.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.