Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5f1d2285ac9f4bd…

MALICIOUS

PDF

12.9 KB Created: 2019-05-01 19:28:13 +01:00 Authoring application: mPDF 5.7
MD5: c142928fbc15c75cd8235da7bba244e8 SHA-1: d28ff6a1a2afec9342c98df8839616cd86bd78e7 SHA-256: b5f1d2285ac9f4bdf92718a65b8f25e0b7da87d33a60131d5efe0a3e0cf080ec
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various book titles hosted on loaminoo.linkpc.net. While the individual URLs are marked as benign, the sheer volume and the nature of the heuristic suggest a link farm designed to drive traffic or potentially host malicious content. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9006

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5096098098090099/Ivanhoe---A-Romance-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/6093098090099090/Ivanhoe-The-Talisman-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/9093091096090090/Ivanhoe-Annotated-A-Romance-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/6093098090096099/Ivanhoe-Classics-Illustrated-2-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/5099090093097093/Ivanho-Annot-Version-fran-aise-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/8092092090096099/Lady-of-the-Lake-Walter-Scott-1910-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/6093098091098099/Cliffsnotes-on-Scott-s-Ivanhoe-by-Norma-Ostrander.pdf
    • http://loaminoo.linkpc.net/3095093094096096/Rob-Roy-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/4094090094098094/The-Monastery-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/5093090099092/Old-Mortality-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/3093090099094094/Marmion-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/8096094099096092/Guy-Mannering-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/8097094090099/The-Heart-of-Mid-Lothian-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/8094090090097099/Sir-Walter-Scott-A-Lecture-at-the-Sorbonne-by-W-P-Ker.pdf
    • http://loaminoo.linkpc.net/1090093097090093/The-Lady-of-the-Lake-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/1091099091095094091/Waverley-or-Tis-Sixty-Years-Since-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/4098097094090097/The-Fair-Maid-of-Perth-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/6093096099095092/Waverley-oder-So-war-s-vor-sechzig-Jahren-by-Walter-Scott.pdf
    • http://loaminoo.linkpc.net/1094096098097099/The-Laird-of-Abbotsford-A-View-of-Sir-Walter-Scott-by-A-N-Wilson.pdf
    • http://loaminoo.linkpc.net/3093090093094093/The-Waverly-Novels-The-Chronicles-of-the-Canongate-by-Walter-Scott.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.