Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad452eabc2b9198d…

MALICIOUS

PDF

15.2 KB Created: 2019-04-30 01:54:53 +01:00 Authoring application: mPDF 5.7
MD5: a813b748b8e71dfac168bbcc1ed5049a SHA-1: 0aa293b4a1f1abced856bab4ed73752d71333704 SHA-256: ad452eabc2b9198d3a2420e1d22ddbd2d4c76c64a54a2604511b2e7c785eb400
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While the specific URLs extracted were labeled as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO poisoning or to distribute further malware. The ML_NYX_PDF_MALICIOUS heuristic also strongly indicates maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8093096097094094/Jean-Haines-World-of-Watercolour-by-Jean-Haines.pdf
    • http://loaminoo.linkpc.net/8093096097094093/The-Collected-Works-Of-Max-Haines-by-Max-Haines.pdf
    • http://loaminoo.linkpc.net/3093091096090091/Touched-by-Carolyn-Haines.pdf
    • http://loaminoo.linkpc.net/2090090094096099/One-Last-Love-by-Derek-Haines.pdf
    • http://loaminoo.linkpc.net/2095090096094097/My-Take-Away-Vampire-by-Derek-Haines.pdf
    • http://loaminoo.linkpc.net/9090091096091096/Tea-At-Gunter-s-by-Pamela-Haines.pdf
    • http://loaminoo.linkpc.net/1090097094095097/February-the-Fifth-by-Derek-Haines.pdf
    • http://loaminoo.linkpc.net/4099094095098094/Wolf-at-the-Threshold-by-Ronald-L-Haines.pdf
    • http://loaminoo.linkpc.net/8095099091090/Deceived-by-the-Others-H-amp-W-Investigations-3-by-Jess-Haines.pdf
    • http://loaminoo.linkpc.net/4096095095098099/Milo-Moon-by-Derek-Haines.pdf
    • http://loaminoo.linkpc.net/9092090096090/Slice-of-Life-by-Paul-Haines.pdf
    • http://loaminoo.linkpc.net/8095094098094/Hunted-by-the-Others-H-amp-W-Investigations-1-by-Jess-Haines.pdf
    • http://loaminoo.linkpc.net/4091094095090095/The-Diamond-Waterfall-by-Pamela-Haines.pdf
    • http://loaminoo.linkpc.net/6099097095095098/Walking-with-Dinosaurs-A-Natural-History-by-Tim-Haines.pdf
    • http://loaminoo.linkpc.net/5093097096097096/World-War-2-Heroes-Jean-Moulin-amp-The-French-Resistance-Forces-in-WWII-World-War-2-World-War-II-WWII-WW2-Jean-Moulin-French-Resistance-Book-1-by-Ryan-Jenkins.pdf
    • http://loaminoo.linkpc.net/3093097097095091/Ham-Bones-Sarah-Booth-Delaney-7-by-Carolyn-Haines.pdf
    • http://loaminoo.linkpc.net/3093091093091093/Kiss-Me-Hard-Before-You-Go-Hearts-of-Haines-1-by-Shannon-McCrimmon.pdf
    • http://loaminoo.linkpc.net/2097092092090094/The-Product-Manager-s-Desk-Reference-by-Steven-Haines.pdf
    • http://loaminoo.linkpc.net/8093096095097095/Smoke-and-Mirrors-Blackhollow-Academy-1-by-Jess-Haines.pdf
    • http://loaminoo.linkpc.net/4096095095099099/The-Adventures-of-Hal-The-Hilarious-Glothic-Tales-2-by-Derek-Haines.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.