Malicious PDF — malware analysis report

Static analysis result for SHA-256 a948bede0b051f2b…

MALICIOUS

PDF

26.6 KB Created: 2019-05-01 17:16:42 +01:00 Authoring application: mPDF 5.7
MD5: 07fcd21fca445001f5d503a73b82e1cc SHA-1: d0eebdc70a73934717fe2e70e37deaf31e902c37 SHA-256: a948bede0b051f2bb4146dc0459b8971a75d042aa7db29036e74884a66773ded
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, many of which are numeric slugs pointing to what appear to be book titles. This suggests a link farm or SEO poisoning attack, where the PDF is designed to drive traffic to specific URLs, potentially for malicious purposes. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9908

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1096093090099096/Poetry-and-Change-Donne-Milton-Wordsworth-and-the-Equilibrium-of-the-Present-by-Josephine-Miles.pdf
    • http://loaminoo.linkpc.net/7098090099090/JOHN-DONNE-COMPLETE-WORKS-ULTIMATE-COLLECTION-All-Poems-Love-Poetry-Holy-Sonnets-Devotions-Meditations-English-Poems-Sermons-PLUS-BIOGRAPHIES-and-ANNOTATIONS-Annotated-by-John-Donne.pdf
    • http://loaminoo.linkpc.net/8094099092096/The-Complete-Poetry-and-Selected-Prose-by-John-Donne.pdf
    • http://loaminoo.linkpc.net/2093096093097/Collected-Poems-by-Josephine-Miles.pdf
    • http://loaminoo.linkpc.net/6090090091091/The-Works-of-William-Wordsworth-Wordsworth-Collection-by-William-Wordsworth.pdf
    • http://loaminoo.linkpc.net/1090090090092096095/Milton-s-Comus-Lycidas-and-Other-Poems-and-Matthew-Arnold-s-Address-on-Milton-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/4099093091098091/The-Orange-Tree-South-Australian-Poetry-To-The-Present-Day-by-Christine-Churches.pdf
    • http://loaminoo.linkpc.net/2099098091098096/Ruin-the-Sacred-Truths-Poetry-amp-Belief-from-the-Bible-to-the-Present-by-Harold-Bloom.pdf
    • http://loaminoo.linkpc.net/6096094097099/A-Native-Clearing-Filipino-Poetry-and-Verse-from-English-Since-the-50s-to-the-Present-Edith-L-Tiempo-to-Cirilo-F-Bautista-by-G-mino-H-Abad.pdf
    • http://loaminoo.linkpc.net/1090090090094094093/Milton-Comus-Lycidas-l-Allegro-Il-Penseroso-and-Selected-Sonnets-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/1090090090094093095/L-Allegro-Il-Penseroso-and-Lycidas-with-Life-of-Milton-Introd-and-Notes-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/1090090090093095097/Milton-Lyrics-L-Allegro-Il-Penseroso-Comus-and-Lycidas-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/1090090090094099091/Milton-s-L-Allegro-Il-Penseroso-and-Lycidas-Ed-with-an-Intr-Paraphrase-and-Vocabularies-by-F-S-Aldhouse-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/1090090090094098090/Milton-s-Comus-Lycidas-and-Other-Poems-And-Matthew-Arnold-s-Address-on-Milton-by-Andrew-J-George.pdf
    • http://loaminoo.linkpc.net/1090090090093095092/Milton-poems-1645-and-lycidas-1638-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/1090090090094099094/Milton-s-Samson-Agonistes-and-Lycidas-With-Numerous-Illustrative-Notes-Etc-Adapted-for-Use-in-Training-Colleges-and-Schools-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/1090090090094094098/Milton-s-Samson-Agonistes-and-Lycidas-With-Numerous-Illustrative-Notes-Adapted-for-Use-in-Training-Colleges-and-Schools-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/1090090090094098096/Milton-s-Paradise-Lost-Books-I-and-II-Comus-Lycidas-Il-Penseroso-and-L-Allegro-with-Intr-Notes-and-Glossary-by-J-G-Davis-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/2095096093095098/500-Miles-500-Miles-1-An-MLR-Mixed-Tape-by-Parker-Williams.pdf
    • http://loaminoo.linkpc.net/1091096098093094091/Areopagitica-A-speech-of-Mr-John-Milton-for-the-Liberty-of-Unlicenc-d-Printing-to-the-Parlament-of-England-Annotated-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/2093096093097/Collected-Po

Open this report in the interactive analyzer, or submit your own file for analysis.