Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1be228ea6432147…

MALICIOUS

PDF

18.7 KB Created: 2019-05-02 18:05:29 +01:00 Authoring application: mPDF 5.7
MD5: 0a8ef96ff70e2b11827fbb601f26b3e6 SHA-1: a309ccfbf155dd08cbc09f7b4ac3d295adf32ee0 SHA-256: c1be228ea6432147dda7b4bb859630e8ed478ba5f2d644cd1864509f98d554ef
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. While the extracted URLs themselves are marked as benign, the sheer volume and the heuristic firing suggest a malicious intent behind the document's construction.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2096097094093097/The-Young-Widow-Phillip-Bethancourt-and-Jack-Gibbons-Mysteries-1-by-Cassandra-Chan.pdf
    • http://loaminoo.linkpc.net/2096097094092098/Village-Affairs-Phillip-Bethancourt-and-Jack-Gibbons-Mysteries-2-by-Cassandra-Chan.pdf
    • http://loaminoo.linkpc.net/2092097096096095/The-Widow-Next-Door-Learning-to-live-again-as-a-young-widow-and-single-mom-after-losing-my-husband-to-suicide-by-Heather-Cruz.pdf
    • http://loaminoo.linkpc.net/2096096099091095/Trick-of-the-Mind-by-Cassandra-Chan.pdf
    • http://loaminoo.linkpc.net/6095099095094094/Psychic-Undercover-With-The-Undead-The-SDF-Paranormal-Mysteries-1-by-Amie-Gibbons.pdf
    • http://loaminoo.linkpc.net/3099095090097097/Jack-s-Widow-by-Eve-Pollard.pdf
    • http://loaminoo.linkpc.net/5091095099091099/Black-Widow-Jack-Parlabane-7-by-Christopher-Brookmyre.pdf
    • http://loaminoo.linkpc.net/1091097093092094/From-Poor-Migrant-to-Millionaire-Chan-Wing-1873-1947-by-King-Nui-Chan.pdf
    • http://loaminoo.linkpc.net/2090098099090091/The-Cassandra-Project-by-Jack-McDevitt.pdf
    • http://loaminoo.linkpc.net/4095096090093096/Young-Cam-Jansen-and-the-Circus-Mystery-Young-Cam-Jansen-Mysteries-17-by-David-A-Adler.pdf
    • http://loaminoo.linkpc.net/1092094099094095/Action-Men-with-Silly-Putty-A-Jack-Donegal-Mystery-Jack-Donegal-Mysteries-Book-1-by-Susan-Joy-Clark.pdf
    • http://loaminoo.linkpc.net/6091097092098092/The-Francis-Chan-Collection-Crazy-Love-Forgotten-God-Erasing-Hell-and-Multiply-by-Francis-Chan.pdf
    • http://loaminoo.linkpc.net/2096097097093096/Jack-Stenhouse-Mysteries-by-Frank-A-Ruffolo.pdf
    • http://loaminoo.linkpc.net/1094092094091/The-Dog-Days-of-Arthur-Cane-by-T-Ernesto-Bethancourt.pdf
    • http://loaminoo.linkpc.net/5093093092097092/Stone-and-Sand-The-Young-Raleigh-Harmon-Mysteries-3-by-Sibella-Giorello.pdf
    • http://loaminoo.linkpc.net/4093097097095097/Historical-Markers-North-Dakota-by-Jack-Young.pdf
    • http://loaminoo.linkpc.net/5093099097097/Grave-Guide-Find-their-Graves-by-Jack-Young.pdf
    • http://loaminoo.linkpc.net/6095090093095/I-Am-Jackie-Chan-My-Life-in-Action-by-Jackie-Chan.pdf
    • http://loaminoo.linkpc.net/3093097093098099/The-Third-Murderer-Richard-and-Morgana-MacKenzie-Mysteries-1-by-Jack-Flanagan.pdf
    • http://loaminoo.linkpc.net/6096099092090096/Accidentally-on-Purpose-Gracie-Greene-Mysteries-2-by-Jack-Parker.pdf
    • http://loaminoo.linkpc.net/1091097093092094/From-Poor-Migrant-t

Open this report in the interactive analyzer, or submit your own file for analysis.