Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9ad3b1ed45b82db…

MALICIOUS

PDF

17.3 KB Created: 2019-04-30 04:38:06 +01:00 Authoring application: mPDF 5.7
MD5: 112c64a848168dad259d6c79b0f39049 SHA-1: fa0cf32e042c5e65dad54c408259e693849fbdc4 SHA-256: a9ad3b1ed45b82db5535967d201cd4ca52abb8bf0aaf11b60f61ba3c6ec67355
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The embedded URLs, while currently labeled benign, are part of a link farm strategy that is often used to distribute malicious content or manipulate search engine results. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1095098096098097/Cosa-Nostra-A-History-of-the-Sicilian-Mafia-by-John-Dickie.pdf
    • http://loaminoo.linkpc.net/9096097097092094/Midnight-In-Sicily-On-Art-Feed-History-Travel-and-la-Cosa-Nostra-by-Peter-Robb.pdf
    • http://loaminoo.linkpc.net/6095099094097093/La-Cosa-Nostra-This-Thing-of-Ours-by-Amie-Nichols.pdf
    • http://loaminoo.linkpc.net/2097092098092091/Men-of-Honor-Cosa-Nostra-1-by-Jasmine-Denton.pdf
    • http://loaminoo.linkpc.net/9090093090094091/Cosas-de-la-Cosa-Nostra-by-Giovanni-Falcone.pdf
    • http://loaminoo.linkpc.net/6094094099098090/The-Business-of-Organized-Crime-A-Cosa-Nostra-Family-Hoover-Institution-publication-201-by-Annelise-Anderson.pdf
    • http://loaminoo.linkpc.net/9096097095095098/Pakhan-s-Salvation-Pakhan-2-Bratva-amp-Cosa-Nostra-2-by-V-F-Mason.pdf
    • http://loaminoo.linkpc.net/7092094091090097/Dickie-Dick-Dickens---Dickie-gegen-Chicago-by-Rolf-A-Becker.pdf
    • http://loaminoo.linkpc.net/7092094091097090/Dirty-Dickie-s-Dynamite-Dick-Book-I-Dickie-at-18-by-V-J-Leone.pdf
    • http://loaminoo.linkpc.net/7092094091097092/Inside-The-Foreign-Office-by-John-Dickie.pdf
    • http://loaminoo.linkpc.net/7092094092093091/Darkest-Italy-The-Nation-and-Stereotypes-of-the-Mezzogiorno-1860-1900-by-John-Dickie.pdf
    • http://loaminoo.linkpc.net/7092094091091091/Evil-Summer-Babe-Leopold-Dickie-Loeb-and-the-Kidnap-Murder-of-Bobby-Franks-by-John-Theodore.pdf
    • http://loaminoo.linkpc.net/9097092090093090/Mafia-Mistress-Mafia-2-by-Nikki-Kitchen.pdf
    • http://loaminoo.linkpc.net/9097092090093095/family-Mafia-Mafia-5-by-Nikki-Kitchen.pdf
    • http://loaminoo.linkpc.net/2097099091093099/Mafia-Dynasty-The-Rise-and-Fall-of-the-Gambino-Crime-Family-by-John-H-Davis.pdf
    • http://loaminoo.linkpc.net/2092093095094094/So-You-Wanna-Be-a-Mobster-Get-Made-Get-Paid-Get-Babes--Start-Your-Own-Mafia-Family-by-John-Sialiano.pdf
    • http://loaminoo.linkpc.net/7092094091097095/The-Little-Book-of-Dickie-Bird-by-Dickie-Bird.pdf
    • http://loaminoo.linkpc.net/3092098090097093/Sicilian-Uncles-by-Leonardo-Sciascia.pdf
    • http://loaminoo.linkpc.net/3097094092098096/The-Sicilian-s-Mistress-by-Lynne-Graham.pdf
    • http://loaminoo.linkpc.net/2090093094093093/The-Sicilian-s-Virgin-Bride-by-Sarah-Morgan.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.