Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5ddbc422b843825…

MALICIOUS

PDF

13.1 KB Created: 2019-05-01 20:37:41 +01:00 Authoring application: mPDF 5.7
MD5: a439bfac59bbc31884aa065a49566a0f SHA-1: 43d537bb844791e793e7601f96e22391d06651c2 SHA-256: d5ddbc422b843825d211e9b6f79154cb8d7941cb71e810fffd70ff38568c8fcc
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to a domain that hosts numerous PDF files. The ML classifier also flagged this PDF as malicious. While the document body is heavily obfuscated, the presence of these links suggests a lure to a website that may host malicious content or be used for SEO spam. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc
    • http://loaminoo.linkpc.net/1091092091097097099/Moonstone-New-Edition-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/9098095092096099/The-Woman-in-White-by-Wilkie-Collins---Delphi-Classics-Illustrated-Delphi-Parts-Edition-Wilkie-Collins-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/3099097097099095/No-Name-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/1090098094096098091/Miss-or-Mrs-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/8094099093093/Basil-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/8093092097093/Armadale-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/4094099099099099/The-Law-and-the-Lady-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/3095091096097090/After-Dark-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/2095093097094098/The-Law-and-the-Lady-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/3090096090099097/Blind-Love-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/1090099092096092090/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/6099099092092090/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/3094097098099096/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/9096096098093097/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/5097095092098096/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/8094095097096096/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/2096091092096099/The-Haunted-Hotel-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/8097092090095090/La-donna-in-bianco-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/3092095091096/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/2095095093093094/The-Woman-in-White-by-Wilkie-Collins.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.