Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbd06b3327fc09f8…

MALICIOUS

PDF

17.6 KB Created: 2019-04-30 05:32:48 +01:00 Authoring application: mPDF 5.7
MD5: 27ed2e463bad8564d45d75c6c0900fb7 SHA-1: f6782ec7932bd929c57325be696f85f1938069bc SHA-256: cbd06b3327fc09f832e983294dba97689de72564bb6f20c0e0cb5711f8bc0489
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded URLs pointing to a link farm, suggesting a SEO poisoning or content-scraping attempt. While the URLs themselves are currently marked as benign, the sheer volume and structure indicate a malicious intent to drive traffic or potentially host malicious content indirectly.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1093090092096090/Full-Moon-Flood-Tide-Bill-Proctor-s-Raincoast-by-Bill-Proctor.pdf
    • http://loaminoo.linkpc.net/1090094093095090091/Doctor-Proctor-s-Fart-Powder-The-Great-Gold-Robbery-Doctor-Proctor-4-by-Jo-Nesb-.pdf
    • http://loaminoo.linkpc.net/3090092096099090/September-Moon-by-Candice-Proctor.pdf
    • http://loaminoo.linkpc.net/4093091098095/Zero-Tolerance-a-Virgil-Roy-Proctor-novel-by-J-D-Knight.pdf
    • http://loaminoo.linkpc.net/1090090090092095/Whispers-of-Heaven-by-Candice-Proctor.pdf
    • http://loaminoo.linkpc.net/9092094098093090/Landslide-True-Stories-by-Minna-Proctor.pdf
    • http://loaminoo.linkpc.net/4095096092097098/After-the-Summerland-The-Witches-of-Spring-Hill-1-by-Patricia-A-Proctor.pdf
    • http://loaminoo.linkpc.net/3097095096097093/Breaking-the-Bond-The-Witches-of-Spring-Hill-2-by-Patricia-A-Proctor.pdf
    • http://loaminoo.linkpc.net/3097094099091098/Crafted-Truths-The-Witches-of-Spring-Hill-3-by-Patricia-A-Proctor.pdf
    • http://loaminoo.linkpc.net/3098094098099096/Bill-Mauldin-s-Army-Bill-Mauldin-s-Greatest-World-War-II-Cartoons-by-Bill-Mauldin.pdf
    • http://loaminoo.linkpc.net/4093096096099096/The-Graves-Are-Not-Yet-Full-Race-Tribe-and-Power-in-the-Heart-of-Africa-by-Bill-Berkeley.pdf
    • http://loaminoo.linkpc.net/1091099098096092095/Bill-W-The-absorbing-and-deeply-moving-life-story-of-Bill-Wilson-co-founder-of-Alcoholics-Anonymous-by-Robert-Thomsen.pdf
    • http://loaminoo.linkpc.net/1096093098093097/A-Field-Guide-to-the-Southeast-Coast-Gulf-of-Mexico-Coastal-Habitats-Seabirds-Marine-Mammals-Fish-Other-Wildlife-by-Noble-S-Proctor.pdf
    • http://loaminoo.linkpc.net/4090093094091092/Search-for-the-Phoenix-Phoenix-Series-Book-2-by-Jim-Proctor.pdf
    • http://loaminoo.linkpc.net/2096099097097/The-Shanghai-Moon-Lydia-Chin-amp-Bill-Smith-9-by-S-J-Rozan.pdf
    • http://loaminoo.linkpc.net/5099091091092094/Boule-et-Bill---la-d-couverte-du-P-le-Biblio-Mango-Boule-et-Bill-by-d-39-apr-s-Roba.pdf
    • http://loaminoo.linkpc.net/4092096090098093/The-Bill-James-Guide-to-Baseball-Managers-From-1870-to-Today-by-Bill-James.pdf
    • http://loaminoo.linkpc.net/4094091094099091/Bill-Bruford---The-Autobiography-Yes-King-Crimson-Earthworks-and-More-by-Bill-Bruford.pdf
    • http://loaminoo.linkpc.net/6090095097091093/Album-No-7-Des-gags-de-Boule-et-Bill-Boule-et-Bill-7-by-Jean-Roba.pdf
    • http://loaminoo.linkpc.net/6096091094098/Full-Moon-Kisses-Full-Moon-3-by-Ellen-Schreiber.pdf
    • http://loaminoo.linkpc.net/30980940980

Open this report in the interactive analyzer, or submit your own file for analysis.