Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5a01c61ff90e5be…

MALICIOUS

PDF

42.3 KB Created: 2019-05-03 05:41:23 +01:00 Authoring application: mPDF 5.7
MD5: c45411c618bd1997a2c4a6febad12981 SHA-1: b9c45d801b0918b539add02acaf8c181e0f3c775 SHA-256: c5a01c61ff90e5bee88ab09cccf916ae95773eb4000e04300bbdde7193cd38c3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this as malicious. The document body is heavily obfuscated, but the presence of numerous links to a dynamic DNS domain suggests a link farm or SEO poisoning attack. The primary IOCs are the URLs pointing to these external PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9578

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091092096099097090/New-and-Advanced-Materials-Selected-Papers-2v-International-Conference-on-Manufacturing-Science-and-Engineering-2011-Guilin-China-Advanced-Materials-Research-V-197-8-by-Huaiying-Zhou.pdf
    • http://loaminoo.linkpc.net/1091092096099095097/Advanced-Engineering-Materials-Selected-Papers-3v-Int-l-Conference-on-Manufacturing-Science-and-Engineering-2011-Guilin-China-by-Jianmin-Zeng.pdf
    • http://loaminoo.linkpc.net/1090099091098092090/Database-Systems-for-Advanced-Applications-16th-International-Conference-DASFAA-2011-International-Workshops-GDB-SIM3-FlashDB-SNSMW-DaMEN-DQIS-Hong-Kong-China-April-22-25-2011-Proceedings-by-Jianliang-Xu.pdf
    • http://loaminoo.linkpc.net/1091092096099095092/Advanced-Data-Mining-and-Applications-10th-International-Conference-Adma-2014-Guilin-China-December-19-21-2014-Proceedings-by-Xudong-Luo.pdf
    • http://loaminoo.linkpc.net/8091094094098093/Materials-Science-and-Energy-Engineering-Cmsee-2014---Proceedings-of-the-2014-International-Conference-Proceedings-of-the-2014-International-Conference-by-Shyan-Lung-Chung.pdf
    • http://loaminoo.linkpc.net/4090098090095098/Advanced-Communication-And-Networking-International-Conference-Acn-2011-Brno-Czech-Republic-August-15-17-2011-Proceedings-by-Tai-Hoon-Kim.pdf
    • http://loaminoo.linkpc.net/1091092096098090096/Knowledge-Science-Engineering-and-Management-First-International-Conference-KSEM-2006-Guilin-China-August-5-8-2006-Proceedings-by-Jerome-Lang.pdf
    • http://loaminoo.linkpc.net/8091094094098094/Materials-Science-and-Energy-Engineering-Cmsee-2014---Proceedings-of-the-2014-International-Conference-by-Shyan-Lung-Chung.pdf
    • http://loaminoo.linkpc.net/9094091099097093/Proceedings-of-the-1st-International-Conference-on-Numerical-Modelling-in-Engineering-Vol-2-Numerical-Modelling-in-Mechanical-and-Materials-Engineering-by-Magd-Abdel-Wahab.pdf
    • http://loaminoo.linkpc.net/1090095097092091090/Diffusion-in-Materials-DIMAT-2004-Proceedings-of-the-6th-International-Conference-on-Diffusion-in-Materials-Cracow-Poland-July-18-23-2004-by-Z-Zurek.pdf
    • http://loaminoo.linkpc.net/5098094092096099/Materials-Science-and-Engineering-A-First-Course-by-V-Raghavan.pdf
    • http://loaminoo.linkpc.net/1091091097099091099/Principles-Materials-Science-Engineering-by-William-F-Smith.pdf
    • http://loaminoo.linkpc.net/1091095094098095092/New-Advanced-Materials-Economic-Dynamics-and-European-Strategy-a-Report-from-the-Fast-Programme-of-the-Commission-of-the-European-Communities-by-Patrick-Cohendet.pdf
    • http://loaminoo.linkpc.net/8091094094098090/Electrical-and-Control-Engineering-amp-Materials-Science-and-Manufacturing---The-Proceedings-of-Joint-Conferences-of-the-6th-Icece2015-and-the-4th-Icmsm2015-The-Proceedings-of-Joint-Conferences-of-the-6th-Icece2015-and-the-4th-Icmsm2015-by-Shihong-Qin.pdf
    • http://loaminoo.linkpc.net/1091092096098091090/Icsp-06-2006-8th-International-Conference-on-Signal-Processing-Proceedings-November-16-20-2006-Guilin-China-by-Beijing-Jiao-Tong-Da-Xue.pdf
    • http://loaminoo.linkpc.net/8091094093099093/Electronics-Electrical-Engineering-and-Information-Science-Proceedings-of-the-2015-International-Conference-on-Electronics-Electrical-Engineering-and-Information-Science-Eeeis2015-by-Jian-Wang.pdf
    • http://loaminoo.linkpc.net/9096099095097095/Advanced-Manufacturing-And-Sustainable-Logistics-8th-International-Heinz-Nixdorf-Symposium-Ihns-2010-Paderborn-Germany-April-21-22-2010-Proceedings-Notes-In-Business-Information-Processing-by-Wilhelm-Dangelmaier.pdf
    • http://loaminoo.linkpc.net/1091092096099096095/2007-5th-International-Conference-on-Microwave-and-Millimeter-Wave-Technology-Proceedings-Icmmt-2007-April-19-21-2007-Guilin-China-by-Institute-of-Electrical-and-Electronics-Engineers.pdf
    • http://loaminoo.linkpc.net/1091094091095093093/Selected-Areas-In-Cryptography-11th-International-Workshop-Sac-2004-Waterloo-Canada-August-9-10-2004-Revised-Selected-Papers-Lecture-Notes-In-Computer-Science-Security-And-Cryptology-by-Helena-Handschuh.pdf
    • http://loaminoo.linkpc.net/1091099092092093090/Industrial-Design-Materials-and-Manufacturing-by-Jim-Lesko.pdf
    • http://loaminoo.linkpc.net/1090099091098092090/Database-Systems-for-Advanced-Applications-16th-International-Conference-DASFAA-2011-International-Workshops-GDB-SIM3-Flas

Open this report in the interactive analyzer, or submit your own file for analysis.