Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1f5e8a181533dcb…

MALICIOUS

PDF

13.6 KB Created: 2019-04-30 04:48:05 +01:00 Authoring application: mPDF 5.7
MD5: cfb06402515cc9ace71ebe3a9caf909c SHA-1: a4a6265fc5cec95af48b670627045a39509971bc SHA-256: d1f5e8a181533dcb6bb336559f9a99ecabbd32dd6bf9e7be99b27fb0b090b56e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, many of which are structured as book titles, suggesting a link farm or SEO manipulation tactic. The ML classifier also flagged this PDF as malicious. While the URLs themselves are currently classified as benign, the sheer volume and structure indicate a malicious intent to redirect users or potentially host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2096093090098095/A-Treasury-of-Science-Fiction-by-Groff-Conklin.pdf
    • http://loaminoo.linkpc.net/6095090099090091/Invaders-from-Earth-by-Robert-Silverberg.pdf
    • http://loaminoo.linkpc.net/6095090098096098/Invaders-The-Chronowarp-Invaders-Series-Book-2-by-Vaughn-Heppner.pdf
    • http://loaminoo.linkpc.net/6095090099098090/Invaders-of-the-Rokujouma-Volume-3-Invaders-of-the-Rokujouma-3-by-Takehaya.pdf
    • http://loaminoo.linkpc.net/2093092091096094/Theory-of-Devolution-by-David-Groff.pdf
    • http://loaminoo.linkpc.net/4097090098097091/The-Monsters-of-Templeton-by-Lauren-Groff.pdf
    • http://loaminoo.linkpc.net/4095096099095093/Fates-and-Furies-by-Lauren-Groff.pdf
    • http://loaminoo.linkpc.net/2096093093094092/Dogs-Go-Wolf-by-Lauren-Groff.pdf
    • http://loaminoo.linkpc.net/9092093093091/Eulogy-by-D-T-Conklin.pdf
    • http://loaminoo.linkpc.net/1090093093090/The-House-Girl-by-Tara-Conklin.pdf
    • http://loaminoo.linkpc.net/1091090093099098093/Sophy-s-Stars-by-Caroline-Conklin.pdf
    • http://loaminoo.linkpc.net/4091092097090091/The-House-Girl-by-Tara-Conklin.pdf
    • http://loaminoo.linkpc.net/1091092096099090099/Conklin-s-Atlas-of-the-Worlds-Space-1889-by-Frank-Chadwick.pdf
    • http://loaminoo.linkpc.net/2095098097097099/The-Summer-Jenny-Fell-in-Love-Sweet-Dreams-13-by-Barbara-Conklin.pdf
    • http://loaminoo.linkpc.net/5091096099098092/In-the-Museum-of-Man-Race-Anthropology-and-Empire-in-France-1850-1950-by-Alice-L-Conklin.pdf
    • http://loaminoo.linkpc.net/9099097099095093/Invaders-From-Mars-by-Ray-Garton.pdf
    • http://loaminoo.linkpc.net/6095090099094096/Space-Invaders-by-D-J-McGhee.pdf
    • http://loaminoo.linkpc.net/6095090098099095/The-Invaders-by-Keith-Laumer.pdf
    • http://loaminoo.linkpc.net/6095090099095092/Invaders-by-Jack-Dann.pdf
    • http://loaminoo.linkpc.net/1094098093090094/Kahramana-and-Invaders-by-Ahmad-Mohamad-Ali.pdf
    • http://loaminoo.linkpc.net/5

Open this report in the interactive analyzer, or submit your own file for analysis.