Malicious PDF — malware analysis report

Static analysis result for SHA-256 b63a30983cda5fb5…

MALICIOUS

PDF

19.3 KB Created: 2019-04-30 04:12:30 +01:00 Authoring application: mPDF 5.7
MD5: 1e58ba6575baff39cb2b3e2dbef04d70 SHA-1: d040ae41fd172a502e9b2ca59d1ea4a1081eff6b SHA-256: b63a30983cda5fb597c2a524518300c4a4e5f1e08f124e598b15a6b230c12cda
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While most of these links were individually confirmed as benign, the sheer volume and the ML classifier's high confidence score suggest a malicious intent, likely for SEO spam or to distribute further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3095091091094098/-15-Kimi-ni-Todoke-15-Kimi-ni-Todoke-From-Me-to-You-15-by-Karuho-Shiina.pdf
    • http://loaminoo.linkpc.net/3095091091094097/-14-Kimi-ni-Todoke-14-Kimi-ni-Todoke-From-Me-to-You-14-by-Karuho-Shiina.pdf
    • http://loaminoo.linkpc.net/3095091091095094/Kimi-ni-Todoke-From-Me-to-You-Vol-10-by-Karuho-Shiina.pdf
    • http://loaminoo.linkpc.net/3095091091094099/Kimi-ni-Todoke-From-Me-to-You-Vol-13-by-Karuho-Shiina.pdf
    • http://loaminoo.linkpc.net/3095091091095091/Kimi-ni-Todoke-From-Me-to-You-Vol-11-by-Karuho-Shiina.pdf
    • http://loaminoo.linkpc.net/5090095095090095/Hana-Kimi-For-You-in-Full-Blossom-Vol-15-Hana-Kimi-For-You-in-Full-Blossom-15-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/4095091099098091/Hana-Kimi-For-You-in-Full-Blossom-Vol-5-Hana-Kimi-For-You-in-Full-Blossom-5-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/4094092090095092/Hana-Kimi-For-You-in-Full-Blossom-Vol-22-Hana-Kimi-For-You-in-Full-Blossom-22-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/4095091096095094/Hana-Kimi-For-You-in-Full-Blossom-Vol-2-Hana-Kimi-For-You-in-Full-Blossom-2-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/4094092093095/Hana-Kimi-For-You-in-Full-Blossom-Vol-1-Hana-Kimi-For-You-in-Full-Blossom-1-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/5090095094095095/Hana-Kimi-For-You-in-Full-Blossom-Vol-12-Hana-Kimi-For-You-in-Full-Blossom-12-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/4095091098097092/Hana-Kimi-For-You-in-Full-Blossom-Vol-4-Hana-Kimi-For-You-in-Full-Blossom-4-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/8091092094096098/-16-Kimi-no-Iru-Machi-16-by-Kouji-Seo.pdf
    • http://loaminoo.linkpc.net/8091092094095095/-12-Kimi-no-Iru-Machi-12-by-Kouji-Seo.pdf
    • http://loaminoo.linkpc.net/8091092095096096/-26-Kimi-no-Iru-Machi-26-by-Kouji-Seo.pdf
    • http://loaminoo.linkpc.net/8091092094096092/-14-Kimi-no-Iru-Machi-14-by-Kouji-Seo.pdf
    • http://loaminoo.linkpc.net/8091092094090090/-2-Kimi-no-Iru-Machi-2-by-Kouji-Seo.pdf
    • http://loaminoo.linkpc.net/8091092096091093/-27-Kimi-no-Iru-Machi-27-by-Kouji-Seo.pdf
    • http://loaminoo.linkpc.net/4095093095099098/Hana-Kimi-3-in-1-Edition-Vol-6-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/4095093096096090/Hana-Kimi-3-in-1-Edition-Vol-7-by-Hisaya-Nakajo.pdf
    • http://loaminoo.linkpc.net/4095091099098091/Hana-Kimi-For-You-in-Full-Blossom-Vol-5-Han

Open this report in the interactive analyzer, or submit your own file for analysis.