Malicious PDF — malware analysis report

Static analysis result for SHA-256 b56a54faedb92f6e…

MALICIOUS

PDF

20.0 KB Created: 2019-04-30 19:16:24 +01:00 Authoring application: mPDF 5.7
MD5: b654be6f0a636faa2c89f4cfef635224 SHA-1: 931401fa41d1dd4db8e4aeb21244e19a567df136 SHA-256: b56a54faedb92f6e89aa3fd63fc98fdcc2bbd5fede6ae341f9bc2eb7ead104f0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF was flagged by a machine learning classifier as malicious and contains a large number of embedded external links, a technique often used for SEO manipulation or to host malicious content. While the document body is heavily obfuscated, the presence of numerous links to seemingly unrelated PDF files suggests a link farm or redirection scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090093095098099090/Tertullian-s-Theology-of-Divine-Power-Rutherford-Studies-Series-1-Historical-Theology-Rutherford-Studies-on-Historical-Theology-Rutherford-Studies-on-Historical-Theology-by-Roy-Kearsley.pdf
    • http://loaminoo.linkpc.net/7093090095091098/History-of-Franciscan-Theology-Theology-Series-by-Kenan-Osborne.pdf
    • http://loaminoo.linkpc.net/9091092092099099/Systematic-Theology-Perpspectives-from-Liberation-Theology-Readings-from-Mysterium-Liberationis-by-Jon-Sobrino.pdf
    • http://loaminoo.linkpc.net/6091093098094098/Symphonic-Theology-The-Validity-of-Multiple-Perspectives-in-Theology-by-Vern-Sheridan-Poythress.pdf
    • http://loaminoo.linkpc.net/4095091090097096/Christ-Plays-in-Ten-Thousand-Places-A-Conversation-in-Spiritual-Theology-Spiritual-Theology-1-by-Eugene-H-Peterson.pdf
    • http://loaminoo.linkpc.net/1091095092091095099/Early-Latin-theology-Selections-from-Tertullian-Cyprian-Ambrose-and-Jerome-by-S-L-Greenslade.pdf
    • http://loaminoo.linkpc.net/7098093091098099/The-Divine-Names-The-Mystical-Theology-by-Pseudo-Dionysius-the-Areopagite.pdf
    • http://loaminoo.linkpc.net/1090095090092095/The-Theology-of-the-Body-Human-Love-in-the-Divine-Plan-by-John-Paul-II.pdf
    • http://loaminoo.linkpc.net/5094092090097092/Church-Charism-and-Power-Liberation-Theology-and-the-Institutional-Church-by-Leonardo-Boff.pdf
    • http://loaminoo.linkpc.net/4092098097095093/Beyond-Theology-by-Alan-W-Watts.pdf
    • http://loaminoo.linkpc.net/3096093097095098/Theology-101-by-Braden-Pedersen.pdf
    • http://loaminoo.linkpc.net/1095099093095098/Pub-Theology-by-Bryan-Berghoef.pdf
    • http://loaminoo.linkpc.net/1090092090097099090/Habermas-and-Theology-by-Nicholas-Adams.pdf
    • http://loaminoo.linkpc.net/3096091097099090/Systematic-Theology-by-Charles-Hodge.pdf
    • http://loaminoo.linkpc.net/9099095098096093/New-Testament-Theology-by-Joachim-Jeremias.pdf
    • http://loaminoo.linkpc.net/3096092095096092/Systematic-Theology-by-Louis-Berkhof.pdf
    • http://loaminoo.linkpc.net/8098097096099/Process-Theology-by-John-B-Cobb-Jr-.pdf
    • http://loaminoo.linkpc.net/7098092092092/God-in-the-Dock-Essays-on-Theology-and-Ethics-by-C-S-Lewis.pdf
    • http://loaminoo.linkpc.net/9095092093096098/A-Theology-of-the-New-Testament-by-George-Eldon-Ladd.pdf
    • http://loaminoo.linkpc.net/1091093098097095094/Practical-Theology-of-Liberation-by-Hugo-Assmann.pdf
    • http://loaminoo.linkpc.net/6091093098094098/Symphonic-Theology-The-Validity-of-Multiple-Perspectives-in-Theology-by-Vern-Sheridan