Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2a7a087b80d4e88…

MALICIOUS

PDF

13.4 KB Created: 2019-04-30 04:12:08 +01:00 Authoring application: mPDF 5.7
MD5: b0de485dfb0acb0525cd3c494622db39 SHA-1: 1c22d8ac378bcedd467b6c9eff19ec5f425fb65c SHA-256: c2a7a087b80d4e881300c6ae61be822a330abc87ef177f337dca9007d3419e5f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to a single domain, indicative of a link farm or SEO abuse. The ML classifier also flagged this PDF as malicious. The primary attack pattern observed is the redirection to a large collection of external PDF files, likely to obscure malicious intent or distribute unwanted content. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3099096093096094/Sadar-s-Keep-The-Queen-s-Quarter-2-by-Midori-Snyder.pdf
    • http://loaminoo.linkpc.net/6098093098091096/Midori-Days-Volume-2-Midori-Days-2-by-Kazurou-Inoue.pdf
    • http://loaminoo.linkpc.net/6098093097091091/Midori-Days-Volume-1-Midori-Days-1-by-Kazurou-Inoue.pdf
    • http://loaminoo.linkpc.net/3094097094097095/His-Convenient-Husband-Innamorati-1-by-J-L-Langley.pdf
    • http://loaminoo.linkpc.net/9099093099098091/On-Bread-amp-Poetry-A-Panel-Discussion-with-Gary-Snyder-Lew-Welch-amp-Philip-Whalen-by-Gary-Snyder.pdf
    • http://loaminoo.linkpc.net/1091099091090090/End-of-the-Beginning-by-Jon-Snyder.pdf
    • http://loaminoo.linkpc.net/4096099095099090/Joy-Ride-by-J-M-Snyder.pdf
    • http://loaminoo.linkpc.net/4091099093090091/For-the-Boys-by-J-M-Snyder.pdf
    • http://loaminoo.linkpc.net/2090097090093090/The-Name-on-My-Wrist-by-J-M-Snyder.pdf
    • http://loaminoo.linkpc.net/7094092092092/Pierced-Love-by-T-H-Snyder.pdf
    • http://loaminoo.linkpc.net/5090091091098093/Desolation-Run-by-James-Snyder.pdf
    • http://loaminoo.linkpc.net/4090091092092091/Outside-In-Insider-2-by-Maria-V-Snyder.pdf
    • http://loaminoo.linkpc.net/3091098097091093/You-ve-Been-Touched-Touch-3-5-by-T-H-Snyder.pdf
    • http://loaminoo.linkpc.net/7093099090099093/Fuck-the-Foreplay-by-J-M-Snyder.pdf
    • http://loaminoo.linkpc.net/2098095098094098/Parking-Lot-Hero-by-J-M-Snyder.pdf
    • http://loaminoo.linkpc.net/2095093095097099/A-D-After-Death-by-Scott-Snyder.pdf
    • http://loaminoo.linkpc.net/4097098094090094/A-Cowboy-s-Heart-by-J-M-Snyder.pdf
    • http://loaminoo.linkpc.net/1093097094095/Cat-Running-by-Zilpha-Keatley-Snyder.pdf
    • http://loaminoo.linkpc.net/3091095098091090/The-Bronze-Pen-by-Zilpha-Keatley-Snyder.pdf
    • http://loaminoo.linkpc.net/2093091093098/Turtle-Island-by-Gary-Snyder.pdf
    • http://loaminoo.linkpc.net/3091098

Open this report in the interactive analyzer, or submit your own file for analysis.