Malicious PDF — malware analysis report

Static analysis result for SHA-256 caaffb39cb8bdebf…

MALICIOUS

PDF

14.0 KB Created: 2019-05-04 13:29:59 +01:00 Authoring application: mPDF 5.7
MD5: 182cb0049ac46c48feb67855c74c4487 SHA-1: c12784c749a11303fd644454cb81948cfa53de1d SHA-256: caaffb39cb8bdebf16c73e7c863329f4b1d4583563a4d3d372ac91340012ebc5
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, directing users to numerous other PDF files. The primary heuristic indicates this is a PDF SEO link farm, suggesting a deceptive tactic to drive traffic. The ML classifier strongly supports the malicious verdict. No scripts were extracted, and the document body is heavily obfuscated, but the presence of a large number of links to external PDFs is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9091094098092093/Erbin-des-Feuers-Throne-of-Glass-3-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/9092090095098095/Erbin-des-Feuers-Throne-of-Glass-3-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/7091098094095/Throne-of-Glass-Throne-of-Glass-1-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/4099093094094092/Throne-of-Glass-Throne-of-Glass-1-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/1094096097090090/Throne-of-Glass-Throne-of-Glass-1-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/3092091090092094/Throne-of-Glass-Throne-of-Glass-1-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/3094091097091/Throne-of-Glass-Throne-of-Glass-1-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/1091090095092096/Throne-of-Glass-Throne-of-Glass-1-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/1091099098096090091/Midnatskronen-Throne-of-Glass-2-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/5094094098095094/Midnattskronan-Throne-of-Glass-2-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/1090091093096099091/Die-Sturmbezwingerin-Throne-of-Glass-5-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/5090094094099091/Queen-of-Shadows-Throne-of-Glass-4-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/3098098097095/Crown-of-Midnight-Throne-of-Glass-2-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/1092098099097096/Heir-of-Fire-Throne-of-Glass-3-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/3098096096093/The-Assassin-s-Blade-Throne-of-Glass-0-1--0-5-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/3092098099094/The-Assassin-s-Blade-Throne-of-Glass-0-1-0-5-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/8096098093096099/Kriegerin-im-Schatten-Throne-of-Glass-2-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/2093091091097099/Empire-of-Storms-Throne-of-Glass-5-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/3096090092091/The-Assassin-and-the-Empire-Throne-of-Glass-0-5-by-Sarah-J-Maas.pdf
    • http://loaminoo.linkpc.net/4093090091097098/The-Assassin-and-the-Desert-Throne-of-Glass-0-3-by-Sarah-J-Maas.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.