Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa31cda43eb43f8f…

MALICIOUS

PDF

16.0 KB Created: 2019-04-30 17:52:45 +01:00 Authoring application: mPDF 5.7
MD5: 3690f2e59943128b34084d1125a262bd SHA-1: 6704dec59f8c6e4c0c1aa7de89d337ad8638a366 SHA-256: aa31cda43eb43f8f4852670859989d51bd1260bc1d536f4d77c7bcaafffe24ce
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, indicative of a link farm. The ML classifier strongly flagged this PDF as malicious. The primary attack pattern involves directing users to a network of linked documents, likely for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4099093093099099/The-Vincent-Brothers-Extended-and-Uncut-The-Vincent-Boys-2-by-Abbi-Glines.pdf
    • http://loaminoo.linkpc.net/2096090098097096/The-Vincent-Brothers-The-Vincent-Boys-2-by-Abbi-Glines.pdf
    • http://loaminoo.linkpc.net/6095097091094098/Quelques-Nouvelles-terrifiantes-Le-D-ner-des-bustes---La-Hache-d-or---L-Auberge-pouvantable---Le-No-l-du-petit-Vincent-Vincent---Not-Olympe---La-Femme-au-collier-de-velours-by-Gaston-Leroux.pdf
    • http://loaminoo.linkpc.net/7099098096095098/Paying-Back-Jack-A-Vincent-Calvino-Novel-Vincent-Calvino-10-by-Christopher-G-Moore.pdf
    • http://loaminoo.linkpc.net/1091095092099098095/Parisian-Surreal-The-Interiors-of-Vincent-Darre-by-Vincent-Darre.pdf
    • http://loaminoo.linkpc.net/3090090095090093/The-Neighbor-Experiment-by-Mr-X.pdf
    • http://loaminoo.linkpc.net/1096091094/The-Good-Neighbor-by-A-J-Banner.pdf
    • http://loaminoo.linkpc.net/9095099097096098/Loving-My-Neighbor-by-C-M-Steele.pdf
    • http://loaminoo.linkpc.net/2094099095091091/The-Jewish-Neighbor-by-A-M-Khalifa.pdf
    • http://loaminoo.linkpc.net/9093094090090096/Norman-Vincent-Peale-An-Inspiring-Collection-of-Three-Complete-Books-by-Norman-Vincent-Peale.pdf
    • http://loaminoo.linkpc.net/3095095090095099/Thy-Neighbor-s-Wife-by-Georgia-Beers.pdf
    • http://loaminoo.linkpc.net/4090094094090097/My-Neighbor-Totoro-2-by-Hayao-Miyazaki.pdf
    • http://loaminoo.linkpc.net/3093097096093091/Playing-for-Keeps-Neighbor-from-Hell-1-by-R-L-Mathewson.pdf
    • http://loaminoo.linkpc.net/1097096098097096/Truce-Neighbor-from-Hell-4-by-R-L-Mathewson.pdf
    • http://loaminoo.linkpc.net/1092098098093098/Lick-Your-Neighbor-by-Chris-Genoa.pdf
    • http://loaminoo.linkpc.net/2096096096098091/The-Nosy-Neighbor-by-Fern-Michaels.pdf
    • http://loaminoo.linkpc.net/2090099094097/Loving-Thy-Neighbor-by-Ruth-Scofield.pdf
    • http://loaminoo.linkpc.net/5097093097090/Come-Find-Me-by-Travis-Neighbor-Ward.pdf
    • http://loaminoo.linkpc.net/4091092090098093/My-Neighbor-Seki-Vol-1-by-Takuma-Morishige.pdf
    • http://loaminoo.linkpc.net/2094094099092096/Caught-By-His-Neighbor-by-Fiona-Piper.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.