Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfe66d1212e65d4c…

MALICIOUS

PDF

18.4 KB Created: 2019-05-02 06:17:23 +01:00 Authoring application: mPDF 5.7
MD5: d6645ed5522d3e30e57ab97cd2e6345b SHA-1: 33c6e12de05b3b062c903f000a009bddc33dfc61 SHA-256: bfe66d1212e65d4c8a10f5cb0cad4d3846475cc832d04962008bf690b475b78c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm with 24 external links, a technique often used for SEO manipulation or to distribute malicious payloads. The ML classifier strongly indicated maliciousness. While the document body was unreadable, the PDF structure and embedded URLs suggest a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8094094095095091/Turandot-Full-Score-by-Giacomo-Puccini.pdf
    • http://loaminoo.linkpc.net/4093099092098095/Puccini-s-La-Boheme-the-Dover-Opera-Libretto-Series-by-Giacomo-Puccini.pdf
    • http://loaminoo.linkpc.net/8094094095094094/Letters-of-Giacomo-Puccini-by-Giacomo-Puccini.pdf
    • http://loaminoo.linkpc.net/8094094092099094/Giacomo-Puccini-by-Conrad-Wilson.pdf
    • http://loaminoo.linkpc.net/7098094097092099/Manon-Lescaut-a-lyric-drama-in-four-acts-by-Giacomo-Puccini.pdf
    • http://loaminoo.linkpc.net/7098094097092093/Manon-Lescaut-Die-sch-nsten-Opern-der-Welt-by-Giacomo-Puccini.pdf
    • http://loaminoo.linkpc.net/7098094097092098/Manon-Lescaut-Lyric-Drama-in-Four-Acts-by-Giacomo-Puccini.pdf
    • http://loaminoo.linkpc.net/7098094098092098/Manon-Lescaut-Dramma-Lirico-in-Quattro-Atti-by-Giacomo-Puccini.pdf
    • http://loaminoo.linkpc.net/5096090096093090/Siegfried-in-Full-Score-by-Richard-Wagner.pdf
    • http://loaminoo.linkpc.net/6091093091090095/La-Valse-in-Full-Score-by-Maurice-Ravel.pdf
    • http://loaminoo.linkpc.net/5091092097096/Strut-Full-Score-by-Libby-Larsen.pdf
    • http://loaminoo.linkpc.net/7092092099093091/German-Requiem-in-Full-Score-by-Johannes-Brahms.pdf
    • http://loaminoo.linkpc.net/5090093090090093/Giulio-Cesare-in-Full-Score-by-Georg-Friedrich-H-ndel.pdf
    • http://loaminoo.linkpc.net/5099095094095098/Five-Orchestral-Pieces-and-Pelleas-und-Melisande-in-Full-Score-by-Arnold-Schoenberg.pdf
    • http://loaminoo.linkpc.net/1091092094093094098/The-Magic-Flute-Die-Zauberflote-in-Full-Score-by-Wolfgang-Amadeus-Mozart.pdf
    • http://loaminoo.linkpc.net/7096091095094097/Symphonie-Fantastique-and-Harold-in-Italy-in-Full-Score-by-Hector-Berlioz.pdf
    • http://loaminoo.linkpc.net/1091092094097090091/-Bald-prangt-den-Morgen-zu-verk-nden-finale-No-21-from-quot-Die-Zauberfl-te-quot-Act-2-K620-full-score-by-Wolfgang-Amadeus-Mozart.pdf
    • http://loaminoo.linkpc.net/1091094094098092091/Tief-in-angenehmen-Abenteuern---Giacomo-Casanova-ber-Gl-ck-Liebe-Frauen-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/7090099092098091/Lettre-Inedite-de-Giacomo-Leopardi-a-Charlotte-Bonaparte-Retrouvee-a-Paris-En-1993-by-Giacomo-Leopardi.pdf
    • http://loaminoo.linkpc.net/1091092094096095095/-quot-Bewahret-euch-vor-Weibertucken-quot-No-11-from-quot-Die-Zauberflote-quot-Act-2-K620-Full-Score-by-Wolfgang-Amadeus-Mozart.pdf
    • http://loaminoo.linkpc.net/709209

Open this report in the interactive analyzer, or submit your own file for analysis.