Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8484c3b2e52d316…

MALICIOUS

PDF

14.7 KB Created: 2019-05-02 19:28:17 +01:00 Authoring application: mPDF 5.7
MD5: 06bdef03a3947c2dac5b244dc0d612a4 SHA-1: fb6e1fcd4ed64b5f0a5199b617e5f9166cd1da16 SHA-256: c8484c3b2e52d316f8357eae93805424ded40a397080a6057fef92e96192fd6b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO poisoning attack. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document. While the URLs themselves are marked as benign, the sheer volume and structure indicate a malicious intent to manipulate search results or distribute further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4094096092090097/Songs-of-Insurrection-The-Dragon-Songs-Saga-1-by-J-C-Kang.pdf
    • http://loaminoo.linkpc.net/4094096093091096/Prelude-To-Insurrection-The-Dragon-Songs-Saga-0-5-by-J-C-Kang.pdf
    • http://loaminoo.linkpc.net/4099096096090097/1001-Songs-The-Great-Songs-of-All-Time-and-the-Artists-Stories-and-Secrets-Behind-Them-by-Toby-Creswell.pdf
    • http://loaminoo.linkpc.net/1094096096091095/Monica-Songs-of-Submission-7-5-Songs-of-Dominance-4-by-C-D-Reiss.pdf
    • http://loaminoo.linkpc.net/3097092095090099/Songs-About-A-Boy-Songs-About-A-Girl-3-by-Chris-Russell.pdf
    • http://loaminoo.linkpc.net/2093093099095093/The-Dragon-Scale-Lute-Daughter-of-the-Dragon-Throne-1-by-J-C-Kang.pdf
    • http://loaminoo.linkpc.net/7099099096090/Beg-Songs-of-Submission-1-by-C-D-Reiss.pdf
    • http://loaminoo.linkpc.net/1096092094096/Songs-for-Eve-by-Archibald-MacLeish.pdf
    • http://loaminoo.linkpc.net/8094091099093098/Songs-on-the-Spot-by-Milarepa.pdf
    • http://loaminoo.linkpc.net/4097096093093/Border-Songs-by-Jim-Lynch.pdf
    • http://loaminoo.linkpc.net/1090097090098092094/69-Love-Songs-by-L-D-Beghtol.pdf
    • http://loaminoo.linkpc.net/1098094092090099/Songs-of-Enchantment-by-Ben-Okri.pdf
    • http://loaminoo.linkpc.net/1090095099096090/Songs-Of-Chaos-by-S-N-Lewitt.pdf
    • http://loaminoo.linkpc.net/2097098098091097/Songs-for-the-Devil-and-Death-by-Hal-Duncan.pdf
    • http://loaminoo.linkpc.net/1090093095090090098/Mystic-Songs-of-Meera-by-V-K-Subramanian.pdf
    • http://loaminoo.linkpc.net/7090097091094094/Alleluia-Songs-of-Joy-by-Annie-C-McQueen.pdf
    • http://loaminoo.linkpc.net/2099092097095090/Songs-of-Innocence-by-William-Blake.pdf
    • http://loaminoo.linkpc.net/2099098096099094/Night-Songs-by-Charles-L-Grant.pdf
    • http://loaminoo.linkpc.net/2092092099097/Songs-for-a-Teenage-Nomad-by-Kim-Culbertson.pdf
    • http://loaminoo.linkpc.net/1099096096099096/Selections-From-the-Book-of-Songs-by-Yuanzhong-Xu.pdf
    • http://loaminoo.linkpc.net/1096092094096/Son

Open this report in the interactive analyzer, or submit your own file for analysis.