Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa4c7d785ab3f22b…

MALICIOUS

PDF

15.4 KB Created: 2019-05-02 01:00:20 +01:00 Authoring application: mPDF 5.7
MD5: fcce58c73ca17381627c94739acfe118 SHA-1: 3a309134263cd05673437393ee68cdbc582bc289 SHA-256: aa4c7d785ab3f22b638cf9c24336e9bd5af0654d7cd3796762132298475bcaaf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently classified as benign, the sheer volume and the heuristic firing of PDF_SEO_LINK_FARM indicate a malicious intent, likely for SEO manipulation or to serve as a distribution point for further malicious content. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc
    • http://loaminoo.linkpc.net/6094091095091094/The-Life-and-Letters-of-Marcus-Tullius-Cicero-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091095097092/Works-of-Marcus-Tullius-Cicero-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091097091099/Cicero-s-Brutus-or-History-of-Famous-Orators-also-His-Orator-or-Accomplished-Speaker-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/8091099091090099/Cicero-s-Letters-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/8091099091091092/The-Letters-of-Cicero-Vol-1-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/4092096096095097/On-Old-Age-and-Friendship-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091095091095/On-Government-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/9094095094094/The-Nature-of-the-Gods-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091095091091/Defence-Speeches-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/7094097098097/On-the-Good-Life-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/3092090095095094/On-the-Good-Life-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091094091099/Selected-Letters-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/1090094093098098095/Verrinen-In-Auswahl-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091095090094/On-the-Nature-of-the-Gods-Academics-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/3099097093094091/Selected-Political-Speeches-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091095091098/Laelius-on-Friendship-and-the-Dream-of-Scipio-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091095096099/The-History-of-the-Life-of-Marcus-Tullius-Cicero-by-Conyers-Middleton.pdf
    • http://loaminoo.linkpc.net/6094091096096093/Words-of-Wisdom-Marcus-Tullius-Cicero-by-Students-39-Academy.pdf
    • http://loaminoo.linkpc.net/6094091095091090/How-to-Run-a-Country-An-Ancient-Guide-for-Modern-Leaders-by-Marcus-Tullius-Cicero.pdf
    • http://loaminoo.linkpc.net/6094091097092097/On-Friendship-After-the-Work-by-Marcus-Tullius-Cicero-by-Emanuel-Dimas-de-Melo-Pimenta.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.