Malicious PDF — malware analysis report

Static analysis result for SHA-256 b56b0db987dfb352…

MALICIOUS

PDF

15.1 KB Created: 2019-05-01 20:12:22 +01:00 Authoring application: mPDF 5.7
MD5: b0a1dee8c102b258de5dfd5b95fc9873 SHA-1: 476946458f28cd533dcb8a0d74eca3b4e625ecb0 SHA-256: b56b0db987dfb352bc03f70c3ac0969692b416ecee9ccfd994c9fdf83d18a023
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious File: Malicious PDF

The PDF contains a large number of embedded URLs pointing to book downloads, a technique often used for SEO spam or to distribute malware. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. While the URLs themselves are currently marked as benign, the overall structure and heuristic firings suggest a malicious intent, likely to redirect users to a compromised site or to serve further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6099093094090/The-Spook-s-Sacrifice-Book-6-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/6094097090092/The-Spook-s-Destiny-Book-8-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/7090094098094/Seventh-Son-The-Spook-s-Apprentice-Film-Tie-in-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/7095092093099/Spook-s-Alice-The-Last-Apprentice-Wardstone-Chronicles-12-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/5090092098091096/The-Spook-s-Battle-The-Last-Apprentice-Wardstone-Chronicles-4-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/7095099098093/The-Spook-s-Revenge-The-Last-Apprentice-Wardstone-Chronicles-13-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/5092096091092/The-Spook-s-Apprentice-The-Last-Apprentice-Wardstone-Chronicles-1-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/9093090090096094/The-Warrior-Arena-13-3-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/2099094093099096/The-Beast-Awakens-Aberrations-1-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/9094092090096095/Valentina-Soul-in-Sapphire-by-Joseph-H-Delaney.pdf
    • http://loaminoo.linkpc.net/2093091094094098/The-Dark-Army-Starblade-Chronicles-2-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/4094097091096090/Rage-of-the-Fallen-The-Last-Apprentice-Wardstone-Chronicles-8-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/7091096093094/Spooks-I-Am-Grimalkin-The-Last-Apprentice-Wardstone-Chronicles-9-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/3096091093098/Curse-of-the-Bane-The-Last-Apprentice-Wardstone-Chronicles-2-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/5094099094092/Revenge-of-the-Witch-The-Last-Apprentice-Wardstone-Chronicles-1-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/3094096093091/Revenge-of-the-Witch-The-Last-Apprentice-Wardstone-Chronicles-1-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/2093092090098098/Rage-of-the-Fallen-The-Last-Apprentice-Wardstone-Chronicles-8-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/3097092096093/Night-of-the-Soul-Stealer-The-Last-Apprentice-Wardstone-Chronicles-3-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/6096097095097095/L-pouvanteur-Tome-02-La-mal-diction-de-l-pouvanteur-by-Joseph-Delaney.pdf
    • http://loaminoo.linkpc.net/2092095099094091/Fire-and-Ice-Book-One-Burned-by-Kiara-Delaney.pdf
    • http://loaminoo.linkpc.net/4094097091096090/Rage-of-the-Fallen-The

Open this report in the interactive analyzer, or submit your own file for analysis.