Malicious PDF — malware analysis report

Static analysis result for SHA-256 d206666fb8f5def7…

MALICIOUS

PDF

18.2 KB Created: 2019-05-02 00:42:51 +01:00 Authoring application: mPDF 5.7
MD5: 0ba676dea90f720a5639da9a5ee58c9d SHA-1: 4f65386fa4ac2df81bab825aabce0c1006f3eaab SHA-256: d206666fb8f5def7a28f454b1e2ea758a1efc0f98e37d2b46bf46d0dbcbfa890
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF contains a large number of embedded links, identified as a link farm. The ML classifier strongly indicated maliciousness. The primary attack pattern involves directing users to a multitude of external URLs, likely for further exploitation or phishing. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2090097090099090/Between-Heidi-and-Horror-A-Brief-Memoir-of-the-Somme-by-Stewart-Hennessey.pdf
    • http://loaminoo.linkpc.net/4090090099097095/The-Somme-Heroism-and-Horror-in-the-First-World-War-by-Martin-Gilbert.pdf
    • http://loaminoo.linkpc.net/5098091095094095/Somme-1916-Success-and-Failure-on-the-First-Day-of-the-Battle-of-the-Somme-by-Paul-Kendall.pdf
    • http://loaminoo.linkpc.net/8097094099090096/Horror-Stories-My-Paramedic-Memoir-by-Justin-Lindner.pdf
    • http://loaminoo.linkpc.net/1095097093092095/The-After-Life-A-Memoir-by-Kathleen-Stewart.pdf
    • http://loaminoo.linkpc.net/3094091094091095/The-Other-Boy-by-M-G-Hennessey.pdf
    • http://loaminoo.linkpc.net/4094093097099096/The-Gettysburg-Address-A-Graphic-Adaptation-by-Jonathan-Hennessey.pdf
    • http://loaminoo.linkpc.net/6099098094093098/Blood-Lite-An-Anthology-of-Humorous-Horror-Stories-Presented-by-the-Horror-Writers-Association-by-Kevin-J-Anderson.pdf
    • http://loaminoo.linkpc.net/2096091096097/Best-New-Horror-12-The-Mammoth-Book-of-Best-New-Horror-12-by-Stephen-Jones.pdf
    • http://loaminoo.linkpc.net/4090098094090090/Best-New-Horror-22-The-Mammoth-Book-of-Best-New-Horror-22-by-Stephen-Jones.pdf
    • http://loaminoo.linkpc.net/9095097092091/Best-New-Horror-20-The-Mammoth-Book-of-Best-New-Horror-20-by-Stephen-Jones.pdf
    • http://loaminoo.linkpc.net/9095097094090/Best-New-Horror-14-The-Mammoth-Book-of-Best-New-Horror-14-by-Stephen-Jones.pdf
    • http://loaminoo.linkpc.net/9095099095091/Best-New-Horror-21-The-Mammoth-Book-of-Best-New-Horror-21-by-Stephen-Jones.pdf
    • http://loaminoo.linkpc.net/1091091093098090/Thirteen-Tales-of-Horror-Point-Horror-13-s-by-T-Pines.pdf
    • http://loaminoo.linkpc.net/3096097097097092/Best-New-Horror-16-The-Mammoth-Book-of-Best-New-Horror-16-by-Stephen-Jones.pdf
    • http://loaminoo.linkpc.net/2091093092096091/Tangled-Webs-How-False-Statements-are-Undermining-America-From-Martha-Stewart-to-Bernie-Madoff-by-James-B-Stewart.pdf
    • http://loaminoo.linkpc.net/5095092092090097/Professor-Stewart-s-Hoard-of-Mathematical-Treasures-by-Ian-Stewart.pdf
    • http://loaminoo.linkpc.net/5095092092091090/Payne-Stewart-The-Authorized-Biography-by-Tracey-Stewart.pdf
    • http://loaminoo.linkpc.net/4094097090094092/The-Comic-Book-Story-of-Beer-The-World-s-Favorite-Beverage-from-7000-BC-to-Today-s-Craft-Brewing-Revolution-by-Jonathan-Hennessey.pdf
    • http://loaminoo.linkpc.net/9095092092098092/Welcome-to-Heidi-by-Heidi-Clements.pdf
    • http://loaminoo.linkpc.net/2096091096097/Best-New-Horror-12-The

Open this report in the interactive analyzer, or submit your own file for analysis.