Malicious PDF — malware analysis report

Static analysis result for SHA-256 acfc2c4a5b87546c…

MALICIOUS

PDF

15.6 KB Created: 2019-05-01 18:05:56 +01:00 Authoring application: mPDF 5.7
MD5: 17086e76560dd76a442503cfc71fb1ec SHA-1: 70b80fb7ca0ea736f540862fa264e4f47564b04b SHA-256: acfc2c4a5b87546c0e6a957108013f445e23da9f34c9f77924f0ee1895adecc4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, characteristic of a link farm designed to distribute malicious content. While the specific URLs extracted were labeled as benign, the sheer volume and the heuristic firing indicate a malicious intent to redirect users. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2091096097090095/Willow-Springs-Destiny-5-by-Toni-Blake.pdf
    • http://loaminoo.linkpc.net/3097094090090098/Christmas-in-Destiny-Destiny-7-by-Toni-Blake.pdf
    • http://loaminoo.linkpc.net/9090096094094/Sugar-Creek-Destiny-2-by-Toni-Blake.pdf
    • http://loaminoo.linkpc.net/4093095098091096/Sugar-Creek-Destiny-2-by-Toni-Blake.pdf
    • http://loaminoo.linkpc.net/1091095090096/Half-Moon-Hill-Destiny-6-by-Toni-Blake.pdf
    • http://loaminoo.linkpc.net/7097096097097093/Willow-Springs-70-by-Willow-Springs.pdf
    • http://loaminoo.linkpc.net/5099099093096/Willow-Springs-Troublesome-Creek-2-by-Jan-Watson.pdf
    • http://loaminoo.linkpc.net/4092090096096095/Ty-d-Down-Willow-Springs-Ranch-3-5-by-Laura-Harner.pdf
    • http://loaminoo.linkpc.net/2099097093090099/Hold-Tight-Willow-Springs-Ranch-2-by-L-E-Harner.pdf
    • http://loaminoo.linkpc.net/2090096094098/Letters-to-a-Secret-Lover-by-Toni-Blake.pdf
    • http://loaminoo.linkpc.net/1094098090095092/Letters-to-a-Secret-Lover-by-Toni-Blake.pdf
    • http://loaminoo.linkpc.net/7093098096093/The-Seasons-Vol-2-The-Springs-Box-Set-The-Springs-3-4-by-Elena-Aitken.pdf
    • http://loaminoo.linkpc.net/8095093096099097/Tequila-and-Candy-Hearts-Blueberry-Springs-4-1-Blueberry-Springs-Sweet-Treats-1-by-Jean-Oram.pdf
    • http://loaminoo.linkpc.net/1091095097097095094/The-Ghosts-of-Mystic-Springs-Mystic-Springs-1-by-Mona-Marple.pdf
    • http://loaminoo.linkpc.net/2092095091090094/Christmas-in-Eternity-Springs-Eternity-Springs-12-by-Emily-March.pdf
    • http://loaminoo.linkpc.net/1091098097091090099/The-Secrets-of-Mystic-Springs-Mystic-Springs-2-by-Mona-Marple.pdf
    • http://loaminoo.linkpc.net/3099095094094098/Teaching-Willow-Session-Two-Teaching-Willow-2-by-Paige-James.pdf
    • http://loaminoo.linkpc.net/3095095099091090/Blair-s-Destiny-The-Destiny-Trilogy-Book-2-by-Miranda-Lynn.pdf
    • http://loaminoo.linkpc.net/7093095099098097/Canadian-Rockies-Hot-Springs-Banff-Miette-Radium-2007-08-by-Canadian-Rockies-Hot-Springs.pdf
    • http://loaminoo.linkpc.net/1091094097090095099/Toni-May-Kolner-Kopfe-Kolner-Skizzen-by-Toni-May.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.