Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5bf5f592d9ccec9…

MALICIOUS

PDF

14.2 KB Created: 2019-05-01 17:06:07 +01:00 Authoring application: mPDF 5.7
MD5: 0d26ac0a9f281ff6221a8856081c8955 SHA-1: 563df0f9b37fad36efad5d141669ced055598de5 SHA-256: a5bf5f592d9ccec95f7eeb587f010c1050842b9012dbc4b398c2de05d8bbc98d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents, characteristic of a link farm. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with 21 external links, and the ML classifier also flagged it as malicious. No scripts were extracted from this sample. The attack pattern is to lure users to a large collection of external documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2099098095098094/Tarnhelm-the-Best-Supernatural-Stories-of-Hugh-Walpole-by-Hugh-Walpole.pdf
    • http://loaminoo.linkpc.net/2093092090096097/All-Souls-Night-by-Hugh-Walpole.pdf
    • http://loaminoo.linkpc.net/8099094096091/Gad-s-Hall-The-Haunting-of-Gad-s-Hall-Gad-s-Hall-1-2-by-Norah-Lofts.pdf
    • http://loaminoo.linkpc.net/4098098092099096/The-Castle-of-Otranto-by-Horace-Walpole.pdf
    • http://loaminoo.linkpc.net/5099092091094/Hieroglyphic-Tales-by-Horace-Walpole.pdf
    • http://loaminoo.linkpc.net/4092095096094/The-Castle-of-Otranto-by-Horace-Walpole.pdf
    • http://loaminoo.linkpc.net/1090096092097095097/Hugh-Howey-Twinpack-Vol-1-The-Walk-Up-Nameless-Ridge-amp-Beacon-23-by-Hugh-Howey.pdf
    • http://loaminoo.linkpc.net/6098091093096095/Hugh-Howey-Twinpack-Vol-2-Deep-Blood-Kettle-amp-Second-Suicide-by-Hugh-Howey.pdf
    • http://loaminoo.linkpc.net/9099095091090093/The-Economic-Policy-of-Robert-Walpole-by-Norris-Arthur-Brisco.pdf
    • http://loaminoo.linkpc.net/8093093090092091/Historic-Doubts-on-the-Life-and-Reign-of-King-Richard-the-Third-by-Horace-Walpole.pdf
    • http://loaminoo.linkpc.net/9098096099095096/A-Farthing-Will-Do-by-Not-Stated.pdf
    • http://loaminoo.linkpc.net/1090093098092091091/Heauen-Vpon-Earth-Or-of-True-Peace-and-Tranquillity-of-Minde-by-IOS-Hall-1609-by-Joseph-Hall.pdf
    • http://loaminoo.linkpc.net/9098096098091090/A-Farthing-Will-Do-by-Lilian-Harry.pdf
    • http://loaminoo.linkpc.net/9098096098090099/Summit-by-Harry-Farthing.pdf
    • http://loaminoo.linkpc.net/9098096098097095/Something-Wicked-by-Mari-Farthing.pdf
    • http://loaminoo.linkpc.net/9098097090091095/The-Legend-of-Percy-Fink-by-Farthing.pdf
    • http://loaminoo.linkpc.net/9098096098091095/Sold-for-a-Farthing-by-Clare-Kipps.pdf
    • http://loaminoo.linkpc.net/9098096099095094/The-Uttermost-Farthing-by-Mrs-Belloc-Lowndes.pdf
    • http://loaminoo.linkpc.net/9098097090091099/The-Psychology-of-Consciousness-by-G-William-Farthing.pdf
    • http://loaminoo.linkpc.net/2094091094095098/The-Mystical-Beast-by-Alison-Farthing.pdf
    • http://loaminoo.linkpc.net/1090093098092091091/Heauen-Vpon-Earth-Or-of-True-Peace-and-Tranquillity-of-Minde-by-IOS-Hall-1609-by-Jose

Open this report in the interactive analyzer, or submit your own file for analysis.