Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf231bab9fc4bd84…

MALICIOUS

PDF

19.1 KB Created: 2019-05-03 01:54:52 +01:00 Authoring application: mPDF 5.7
MD5: a1d6ada1f36b70b946db3ede6575daf8 SHA-1: a7c802f590c7f08550a3d25663ba86fbdd3194ae SHA-256: bf231bab9fc4bd8404264834d6415069ec232bf27fe664094e59f0f2d5c933ad
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, forming a link farm. The ML classifier strongly indicated maliciousness. The primary attack pattern appears to be directing users to a multitude of external sites, likely for SEO manipulation or to host further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7090091093090/Hitler-s-Daughter-Hitler-Trilogy-1-by-Jackie-French.pdf
    • http://loaminoo.linkpc.net/9094090092099091/The-Women-Who-Flew-for-Hitler-The-True-Story-of-Hitler-s-Valkyries-by-Clare-Mulley.pdf
    • http://loaminoo.linkpc.net/7094099098098090/Hitler-in-Argentina-The-Documented-Truth-of-Hitler-s-Escape-from-Berlin-by-Harry-Cooper.pdf
    • http://loaminoo.linkpc.net/1091091090091092090/Hitler-s-Last-Witness-the-memoirs-of-Hitler-s-bodyguard-by-Rochus-Misch.pdf
    • http://loaminoo.linkpc.net/9094090092094095/Hitler-s-Last-Witness-The-Memoirs-of-Hitler-s-Bodyguard-by-Rochus-Misch.pdf
    • http://loaminoo.linkpc.net/9092098093097095/Hitler-s-Letters-and-Notes-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/5092093096093097/Mein-Kampf-Illustrated-English-Translation-Edition-Adolf-Hitler-World-War-2-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/9092098093091097/The-Political-Testament-Of-Adolf-Hitler-Recorded-By-Martin-Bormann-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/9098097091096099/World-War-2-Waffen-SS-Soldier-Stories-Eyewitness-Accounts-of-Hitler-s-Elite-Troops-Waffen-SS-World-War-2-WW2-WWII-German-Soldiers-Hitler-by-Ryan-Jenkins.pdf
    • http://loaminoo.linkpc.net/4090097091096093/In-the-Blood-Outlands-Trilogy-1-by-Jackie-French.pdf
    • http://loaminoo.linkpc.net/7094098096091091/MEIN-KAMPF-quot-Stalag-Edition-quot-BY-ADOLF-HITLER-PUBLISHED-BY-THE-GERMANS-DURING-WW2-FOR-THE-INVASION-OF-BRITAIN-IN-1940-THE-ONLY-ENGLISH-MEIN-KAMPF-EVER-AUTHORIZED-BY-THE-GERMAN-NATIONAL-SOCIALISTS-by-Adolf-Hitler.pdf
    • http://loaminoo.linkpc.net/9094090092094097/Hitler-by-A-N-Wilson.pdf
    • http://loaminoo.linkpc.net/4095097098097/Hitler-by-Ian-Kershaw.pdf
    • http://loaminoo.linkpc.net/3090095097093090/Hitler-s-War-by-David-Irving.pdf
    • http://loaminoo.linkpc.net/9097099097095098/Luizen-In-De-Pels-Van-Hitler-by-Jan-Hof.pdf
    • http://loaminoo.linkpc.net/4098096098098090/Hitler-s-Escape-by-Ron-Hansig.pdf
    • http://loaminoo.linkpc.net/4096096098099094/Hitler-s-Children-by-Kurt-Ladner.pdf
    • http://loaminoo.linkpc.net/1090091099093095098/Ich-Glaubte-an-Hitler-by-Baldur-Von-Schirach.pdf
    • http://loaminoo.linkpc.net/9094090092097094/Hitler-and-the-Holocaust-by-Robert-S-Wistrich.pdf
    • http://loaminoo.linkpc.net/1098096098098090/Selling-Hitler-by-Robert-Harris.pdf
    • http://loaminoo.linkpc.net/9098097091096099/World-War-2-Waffen-SS-Soldier-Stories-Eyewitness-Accounts-of-Hitler-s-Elite-Troops-Waffen-SS-World-War-2-WW2-WWI

Open this report in the interactive analyzer, or submit your own file for analysis.