Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1571a757c9abc40…

MALICIOUS

PDF

19.5 KB Created: 2019-05-07 04:02:10 +01:00 Authoring application: mPDF 5.7
MD5: c69c2e916be6271907306852545e3d5a SHA-1: 607ac2f04fc84632e0894bdcf4f6354778d77201 SHA-256: b1571a757c9abc4043f94a3e542eaca6a1e3250f6cdb71faa773fb3767ad7539
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a malicious intent to manipulate search engine results or distribute content. While most extracted URLs are marked as benign, the sheer volume and the ML classifier's high confidence score indicate a likely malicious purpose. No scripts were extracted from this sample, limiting the ability to determine the exact payload or delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seasasac.lflinkup.com/8da8da9da2da2da1/A-Little-Book-of-Loving-Awareness-by-Ann-Linden.pdf
    • http://seasasac.lflinkup.com/9da7da9da3da8da4/Awareness-Book-1-of-Mindsight-by-C-E-Winterland.pdf
    • http://seasasac.lflinkup.com/6da2da1da0da4da5/Awareness-of-Awareness-by-Caleb-Gattegno.pdf
    • http://seasasac.lflinkup.com/7da2da9da7da1da1/The-Expo-Book-by-Gordon-Linden.pdf
    • http://seasasac.lflinkup.com/3da2da1da1da0da6/The-Book-of-Good-Practices-Vol-I-Learning-Mindfulness-and-Self-Awareness-by-Bill-Whitcomb.pdf
    • http://seasasac.lflinkup.com/3da8da9da7da3da8/Fight-for-Liberty-Book-Three-in-the-Liberty-Trilogy-by-Theresa-Linden.pdf
    • http://seasasac.lflinkup.com/4da8da3da8da9da4/Loving-You-Love-is-a-Destination-Book-3-by-Carly-Morgan.pdf
    • http://seasasac.lflinkup.com/3da8da3da8da9da9/Pulling-the-Vampire-s-Braid-A-Loving-Nip-Book-8-by-Charlie-Richards.pdf
    • http://seasasac.lflinkup.com/2da0da8da5da6/A-Loving-Spirit-Lessons-in-Temptation-Series-Book-1-by-Amanda-McCabe.pdf
    • http://seasasac.lflinkup.com/8da8da9da2da6da3/Linden-Hall-no-Aria-Linden-Hall-no-Aria-1-by-Yuki-Kure.pdf
    • http://seasasac.lflinkup.com/9da7da5da1da4da4/Loving-for-you-Loving-Reihe-4-by-Katrin-Bongard.pdf
    • http://seasasac.lflinkup.com/2da9da0da0da8da3/Loving-You-Is-Easy-Loving-You-1-by-Wendy-S-Marcus.pdf
    • http://seasasac.lflinkup.com/1da4da5da2da6da4/Loving-Jay-Loving-You-1-by-Renae-Kaye.pdf
    • http://seasasac.lflinkup.com/3da6da2da1da9da3/Loving-Jay-Loving-You-1-by-Renae-Kaye.pdf
    • http://seasasac.lflinkup.com/2da4da9da1da7da5/Her-Viking-Wolf-50-Loving-States-Colorado-50-Loving-States-3-by-Theodora-Taylor.pdf
    • http://seasasac.lflinkup.com/1da1da4da8da5da8da0/Toys-Meet-Snow-Being-the-Wintertime-Adventures-of-a-Curious-Stuffed-Buffalo-a-Sensitive-Plush-Stingray-and-a-Book-loving-Rubber-Ball-by-Emily-Jenkins.pdf
    • http://seasasac.lflinkup.com/4da2da2da2da5da8/Loving-Her-Means-Loving-HIM-What-it-means-to-be-a-Godly-Husband-by-Donald-E-Graham-Jr-.pdf
    • http://seasasac.lflinkup.com/7da5da4da5da9da6/The-Loving-Husband-Trilogy-The-Complete-Box-Set-Loving-Husband-1-3-by-Meredith-Allard.pdf
    • http://seasasac.lflinkup.com/2da5da0da5da5da8/LUCA---Her-Ruthless-Don-Ruthlessly-Obsessed-Duet-Book-1-50-Loving-States-New-York-Pt-1-Ruthless-Tycoons-3-by-Theodora-Taylor.pdf
    • http://seasasac.lflinkup.com/7da1da1da8da8/Her-Loving-Husband-s-Curse-Loving-Husband-2-by-Meredith-Allard.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.