Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2cb7ac6712e76c6…

MALICIOUS

PDF

17.4 KB Created: 2019-05-02 01:02:32 +01:00 Authoring application: mPDF 5.7
MD5: ad76ccc13635ef73ee6ac37f9624b21c SHA-1: 55634ea917d1eec396672b47fd666838cc149f29 SHA-256: b2cb7ac6712e76c6c747a835432e1d931005eed16ca2fd338f924fdd2158c32c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded links, constituting a link farm. These links likely serve to either distribute further malicious content or to manipulate search engine results. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.l
    • http://loaminoo.linkpc.net/3098097097094/A-Darkness-At-Sethanon-The-Riftwar-Saga-4-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/2097091099094094/Magician-The-Riftwar-Saga-1-2-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3096095097095/Magician-Apprentice-The-Riftwar-Saga-1-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/4097091090094091/Magician-Apprentice-The-Riftwar-Saga-1-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/5098094093096098/The-Complete-Legends-of-the-Riftwar-Trilogy-Honoured-Enemy-Murder-in-Lamut-Jimmy-the-Hand-Legends-of-the-Riftwar-1-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3095090097099098/Krondor-The-Assassins-The-Riftwar-Legacy-2-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/1096096093098090/Jimmy-the-Hand-Legends-of-the-Riftwar-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/5098094093096097/The-Riftwar-Legacy-The-Complete-4-Book-Collection-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/6094096099090/Magician-s-End-The-Chaoswar-Saga-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3096096090091093/Magician-s-End-The-Chaoswar-Saga-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/4091095090091095/Wrath-of-a-Mad-God-The-Darkwar-Saga-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/2097096092099097/A-Kingdom-Besieged-The-Chaoswar-Saga-1-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/5098094093096093/Rage-of-a-Demon-King-Shadow-of-a-Dark-Queen-Rise-of-a-Merchant-Prince-The-Serpentwar-Saga-1-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/5098094094090096/A-Serva-do-Imp-rio-Saga-do-Imp-rio-2---parte-2-2-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/5098094094090091/A-Serva-do-Imp-rio-Saga-do-Imp-rio-2---parte-1-2-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/5098094093095094/The-Complete-Darkwar-Trilogy-Flight-of-the-Nighthawks-Into-a-Dark-Realm-Wrath-of-a-Mad-God-The-Darkwar-Saga-1-3-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/5098094093097090/King-of-Embers-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3099098094093/Faerie-Tale-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/3094094090091093/Faerie-Tale-by-Raymond-E-Feist.pdf
    • http://loaminoo.linkpc.net/1095096094093092/Magician-Apprentice-Volume-2-by-Raymond-E-Feist.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.