Malicious PDF — malware analysis report

Static analysis result for SHA-256 b24f6c0a0825b03e…

MALICIOUS

PDF

18.1 KB Created: 2019-04-30 05:14:56 +01:00 Authoring application: mPDF 5.7
MD5: b3df725af7f49a9eaf46dca2972512ee SHA-1: 5da7356e8c0dc5a22ce04512bc4401178e167feb SHA-256: b24f6c0a0825b03e05b5f8de127f0365e73dac80e917e241594c46df91f2984f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. While the document body is heavily obfuscated, the presence of numerous links suggests a potential for redirecting users to malicious sites or for SEO spamming. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9092093097099098/Legendarium-de-J-R-R-Tolkien-El-Senor-de-Los-Anillos-El-Hobbit-El-Silmarillion-Los-Hijos-de-Hurin-Esbozo-de-la-Mitologia-the-Road-Goes-Ever-O-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/1091094095096098097/El-Se-or-de-los-Anillos-The-Lord-of-the-Rings-1-3-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/9092093098090092/Album-Symphonic-Metal-Design-Your-Universe-the-Heart-of-Everything-01011001-S-amp-m-Enter-Mother-Earth-Children-of-Hurin-the-Silent-Force-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/9093093091097095/Fiktive-Welt-Der-Werke-Tolkiens-Der-Herr-Der-Ringe-Ork-Das-Silmarillion-Quenya-Figuren-in-Tolkiens-Welt-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/6096099092091092/A-Irmandade-do-Anel-O-Se-or-dos-Aneis-1-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/3093090098097/The-Children-of-H-rin-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/3090094091091091/The-Children-of-H-rin-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/5092093097092092/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/5095092093091099/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/5096097098094095/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/5093090099095096/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/7096099099094/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/9098096090099093/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/8093095093095093/De-hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/4093095091099/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/5093093090097/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/6095092092093/The-Hobbit-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/9093092099092091/Tolkien-and-the-Silmarillion-An-Aslan-book-by-Clyde-S-Kilby.pdf
    • http://loaminoo.linkpc.net/9093092098098093/Of-the-Darkening-of-Valinor-amp-of-the-Flight-of-the-Noldor-from-The-Silmarillion-by-J-R-R-Tolkien.pdf
    • http://loaminoo.linkpc.net/5096091093099/The-Hobbit-Part-One-by-J-R-R-Tolkien.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.