Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccb4e6f0ed61d8a2…

MALICIOUS

PDF

16.0 KB Created: 2019-04-30 18:29:43 +01:00 Authoring application: mPDF 5.7
MD5: e7857ff4952b7ece1a46c09801c46b18 SHA-1: ba8dad92b44bd273371a15ddf19f3b86ae5b7a25 SHA-256: ccb4e6f0ed61d8a26c68b2cfeaf3c5d4d0183c171ac069f39b9d58b1799d53b2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, many of which are structured with numeric slugs, indicating a potential SEO link farm. The ML classifier also flagged this PDF as malicious. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly to distribute malware or engage in phishing through these links. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6098097097090099/True-North-Nord-Vrai-by-Jody-Aliesan.pdf
    • http://loaminoo.linkpc.net/7093097099098099/French-Migration-to-North-America-Emigration-Francaise-en-Amerique-du-Nord-by-Jean-Louis-Houde.pdf
    • http://loaminoo.linkpc.net/1095097096091095/True-North-True-Born-Trilogy-2-by-L-E-Sterling.pdf
    • http://loaminoo.linkpc.net/1091099091095093/True-North-The-Shocking-Truth-about-quot-Yours-Mine-and-Ours-quot-by-Tom-North.pdf
    • http://loaminoo.linkpc.net/2093098097095099/True-North-by-Kathryn-Lasky.pdf
    • http://loaminoo.linkpc.net/2091096099098096/True-North-by-Marie-Force.pdf
    • http://loaminoo.linkpc.net/4093090094/Keepsake-True-North-3-by-Sarina-Bowen.pdf
    • http://loaminoo.linkpc.net/2096098091095098/True-North-A-Memoir-by-Jill-Ker-Conway.pdf
    • http://loaminoo.linkpc.net/2097091091097096/True-North-The-Compass-4-by-Tamsen-Parker.pdf
    • http://loaminoo.linkpc.net/3094093092/Bittersweet-True-North-1-by-Sarina-Bowen.pdf
    • http://loaminoo.linkpc.net/5090095093092093/Keepsake-True-North-3-by-Sarina-Bowen.pdf
    • http://loaminoo.linkpc.net/3099096093090095/Finding-West-True-North-1-by-June-Gray.pdf
    • http://loaminoo.linkpc.net/7093093095095093/In-the-Hands-of-A-Chef-Cooking-with-Jody-Adams-of-Rialto-Restaurant-by-Jody-Adams.pdf
    • http://loaminoo.linkpc.net/1095090093096097/True-North-Four-Generations-Volume-I-Mia-by-Judith-Slawson-King.pdf
    • http://loaminoo.linkpc.net/6096098099/Bountiful-True-North-4-Brooklyn-Bruisers-4-5-by-Sarina-Bowen.pdf
    • http://loaminoo.linkpc.net/1091092091093099/True-North-The-Story-of-Mary-and-Elizabeth-Durack-by-Brenda-Niall.pdf
    • http://loaminoo.linkpc.net/4091095095095091/True-North-Lost-Boys-and-Love-Letters-1-by-Bethany-Brown.pdf
    • http://loaminoo.linkpc.net/1098095095096090/Bound-by-Ice-A-True-North-Pole-Survival-Story-by-Sandra-Neil-Wallace.pdf
    • http://loaminoo.linkpc.net/2093098096091093/A-Kim-Jong-Il-Production-The-Incredible-True-Story-of-North-Korea-and-the-Most-Audacious-Kidnapping-in-History-by-Paul-Fischer.pdf
    • http://loaminoo.linkpc.net/5095094097099093/Un-homme-un-vrai-by-Tom-Wolfe.pdf
    • http://loaminoo.linkpc.net/7093093095095093/In-the-Hands-of-A-Chef-Cooking-

Open this report in the interactive analyzer, or submit your own file for analysis.