Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb9da0b77839a786…

MALICIOUS

PDF

20.4 KB Created: 2019-04-30 17:53:17 +01:00 Authoring application: mPDF 5.7
MD5: c3f08e34a21daea96e0bef625b573eed SHA-1: 76c7a37ae88f983cbdbc00e07071a24e3fe30d68 SHA-256: cb9da0b77839a786c56790b949762aff222b3de24e0a559461bd0166807ce931
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a link farm with 25 external links, primarily pointing to book-related PDFs. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the heuristic indicates the document's purpose is to redirect users to a large number of potentially malicious or unwanted external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090094095099093095/The-Dragon-Chronicles-The-Lost-Journals-of-the-Great-Wizard-Septimus-Agorius-by-Malcolm-Sanders.pdf
    • http://loaminoo.linkpc.net/2097096092099096/Wizard-Defiant-Intergalactic-Wizard-Scout-Chronicles-1-by-Rodney-W-Hartman.pdf
    • http://loaminoo.linkpc.net/5091096091090096/Whales-for-the-Wizard-by-Malcolm-Archibald.pdf
    • http://loaminoo.linkpc.net/1090098097090095/A-Symphony-of-Blood-The-Lost-Journals-1-by-Matthew-Swiontek.pdf
    • http://loaminoo.linkpc.net/1090094095098095091/Septimus-Spider-and-the-Fairy-Dress-and-Septimus-Spider-and-the-Missing-Magic-Wand-by-Vic-Woolley.pdf
    • http://loaminoo.linkpc.net/2099099092095098/Dragon-s-Milk-Dragon-Chronicles-1-by-Susan-Fletcher.pdf
    • http://loaminoo.linkpc.net/2091092095099095/Flight-of-the-Dragon-Kyn-Dragon-Chronicles-2-by-Susan-Fletcher.pdf
    • http://loaminoo.linkpc.net/2097099092094/Dragon-s-Blood-Pit-Dragon-Chronicles-1-by-Jane-Yolen.pdf
    • http://loaminoo.linkpc.net/1095096092091093/Septimus-Heap-Box-Set-Magyk-and-Flyte-Septimus-Heap-1-2-by-Angie-Sage.pdf
    • http://loaminoo.linkpc.net/8098093095098093/Lost-in-Translation-Un-bersetzbare-W-rter-aus-der-ganzen-Welt-by-Ella-Frances-Sanders.pdf
    • http://loaminoo.linkpc.net/5093094099097/A-Familiar-Dragon-Fanuilh-Wizard-s-Heir-Beggar-s-Banquet-by-Daniel-Hood.pdf
    • http://loaminoo.linkpc.net/1091092098096094097/Eleanor-Rigby-The-Chronicles-of-Great-Love-and-Fall-of-Great-Empire-by-Zamir-Osorov.pdf
    • http://loaminoo.linkpc.net/1091092098096093099/Eleanor-Rigby-The-Chronicles-of-Great-Love-and-Fall-of-Great-Empire-by-Zamir-Osorov.pdf
    • http://loaminoo.linkpc.net/1097092095093092/The-Rain-Wilds-Chronicles-Dragon-Keeper-Dragon-Haven-City-of-Dragons-and-Blood-of-Dragons-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/7099098091096092/The-Connors-Chronicles-Rise-of-the-Dark-Wizard-by-C-G-Peltier.pdf
    • http://loaminoo.linkpc.net/4094097091092090/A-Wizard-s-Dark-Dominion-The-Gods-and-Kings-Chronicles-Book-1-by-Lee-H-Haywood.pdf
    • http://loaminoo.linkpc.net/1093091096097092/RASL-Vol-4-The-Lost-Journals-of-Nikola-Tesla-RASL-4-by-Jeff-Smith.pdf
    • http://loaminoo.linkpc.net/8099098092096/Making-Malcolm-The-Myth-and-Meaning-of-Malcolm-X-by-Michael-Eric-Dyson.pdf
    • http://loaminoo.linkpc.net/3097094092096097/G-A-Aiken-Dragon-Bundle-The-Dragon-Who-Loved-Me-What-a-Dragon-Should-Know-Last-Dragon-Standing-amp-How-to-Drive-a-Dragon-Crazy-The-Dragon-Kin-3-6-by-G-A-Aiken.pdf
    • http://loaminoo.linkpc.net/1098095096098090/The-Conan-Chronicles-Volume-2-The-Hour-of-the-Dragon-The-Conan-Chronicles-2-by-Robert-E-Howard.pdf
    • http://loaminoo.linkpc.net