Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1e54144b0070716…

MALICIOUS

PDF

15.2 KB Created: 2019-04-30 03:18:51 +01:00 Authoring application: mPDF 5.7
MD5: a0049d1451136842fb8738463d9ed220 SHA-1: 3c45327a6b4c31e10860fb12002486336a4f8a12 SHA-256: d1e54144b0070716cf4744285ecfed106f43a54c764844333c59649e31060667
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified as a link farm, which is a common technique for SEO poisoning and distributing malicious content. The ML classifier also flagged this PDF as malicious. The embedded URLs, such as http://loaminoo.linkpc.net/7097093098092095/The-Cambridge-Companion-to-Spinoza-s-Ethics-by-Olli-Koistinen.pdf, are likely used to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7097093098092095/The-Cambridge-Companion-to-Spinoza-s-Ethics-by-Olli-Koistinen.pdf
    • http://loaminoo.linkpc.net/6094093091095096/The-Cambridge-Companion-to-Chopin-by-Jim-Samson.pdf
    • http://loaminoo.linkpc.net/3095090099094090/The-Cambridge-Companion-to-Liszt-by-Kenneth-Hamilton.pdf
    • http://loaminoo.linkpc.net/1091090099093092092/The-Cambridge-Companion-to-Augustine-by-Eleonore-Stump.pdf
    • http://loaminoo.linkpc.net/1090096090097094095/The-Cambridge-Companion-To-Leonardo-by-Claire-Farago.pdf
    • http://loaminoo.linkpc.net/9090094093090096/The-Cambridge-Companion-to-Hegel-by-Frederick-C-Beiser.pdf
    • http://loaminoo.linkpc.net/6096099098095092/The-Cambridge-Companion-to-Virgil-by-Charles-Martindale.pdf
    • http://loaminoo.linkpc.net/9094093094090091/The-Cambridge-Companion-to-Rilke-by-Karen-Leeder.pdf
    • http://loaminoo.linkpc.net/6096096097096098/The-Cambridge-Companion-to-Schubert-by-Christopher-H-Gibbs.pdf
    • http://loaminoo.linkpc.net/5099094097094093/The-Cambridge-Companion-to-Kierkegaard-by-Alastair-Hannay.pdf
    • http://loaminoo.linkpc.net/6090095091092091/The-Cambridge-Companion-to-Rabelais-by-John-O-39-Brien.pdf
    • http://loaminoo.linkpc.net/1090096092090097099/The-Cambridge-Companion-To-Dietrich-Bonhoeffer-by-John-W-de-Gruchy.pdf
    • http://loaminoo.linkpc.net/6095095094094091/The-Cambridge-Companion-to-Writing-of-the-English-Revolution-by-N-H-Keeble.pdf
    • http://loaminoo.linkpc.net/3093099095096099/The-Cambridge-Companion-to-English-Renaissance-Drama-by-A-R-Braunmuller.pdf
    • http://loaminoo.linkpc.net/4096098093095091/The-Cambridge-Companion-to-Shakespeare-Studies-by-Stanley-Wells.pdf
    • http://loaminoo.linkpc.net/5096098091092097/The-Cambridge-Companion-to-Bertrand-Russell-by-Nicholas-Griffin.pdf
    • http://loaminoo.linkpc.net/4099090094095098/The-Cambridge-Companion-to-Canadian-Literature-by-Eva-Marie-Kr-ller.pdf
    • http://loaminoo.linkpc.net/8091099096095092/The-Cambridge-Companion-to-the-Arthurian-Legend-by-Elizabeth-Archibald.pdf
    • http://loaminoo.linkpc.net/3094096090096099/The-Cambridge-Companion-to-the-African-American-Slave-Narrative-by-Audrey-Fisch.pdf
    • http://loaminoo.linkpc.net/8095094090090092/Spinoza-Oeuvres-compl-tes-et-annexes---14-titres-Nouvelle-dition-enrichie-by-Baruch-Spinoza.pdf
    • http://loaminoo.linkpc.net/6090095091092091/The-Cambridge-Companion-to-Rabelais-by-Jo

Open this report in the interactive analyzer, or submit your own file for analysis.