Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9d9027f3d1c6853…

MALICIOUS

PDF

15.0 KB Created: 2019-05-02 00:54:08 +01:00 Authoring application: mPDF 5.7
MD5: 23f21e997cc392700136d24372885cb4 SHA-1: c3737a3f3e19b82b533578e333b10696c1cff8e8 SHA-256: d9d9027f3d1c6853681186bdee5d199dde0324a3ecd267a2562b1f3c20220222
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently classified as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO poisoning or to distribute further malware. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6091097095092/The-Goblin-Wood-Goblin-Wood-1-by-Hilari-Bell.pdf
    • http://loaminoo.linkpc.net/1094092095090095/Goblin-Hero-Jig-the-Goblin-2-by-Jim-C-Hines.pdf
    • http://loaminoo.linkpc.net/2095093099099096/FREE-WOOD-III-THE-CRATE-BOOK-Upcycling-pallet-wood-into-sturdy-wood-crates-with-precision-and-repeatability-by-T-G-Forge.pdf
    • http://loaminoo.linkpc.net/3095090097097097/Handbook-of-Wood-Chemistry-and-Wood-Composites-by-Roger-M-Rowell.pdf
    • http://loaminoo.linkpc.net/1096095093096095/Natalie-Wood-a-memoir-by-her-sister-by-Lana-Wood.pdf
    • http://loaminoo.linkpc.net/3091091099095093/Merlin-s-Wood-Mythago-Wood-5-by-Robert-Holdstock.pdf
    • http://loaminoo.linkpc.net/2092096098098/Beyond-the-Wood-Beyond-the-Wood-1-by-Michael-J-Roueche.pdf
    • http://loaminoo.linkpc.net/3095094096/Nobody-Likes-a-Goblin-by-Ben-Hatke.pdf
    • http://loaminoo.linkpc.net/6095095099098099/Goblin-Stories-by-Arthur-Daigle.pdf
    • http://loaminoo.linkpc.net/1099099099096096/The-Goblin-and-the-Girl-by-Neil-Irani.pdf
    • http://loaminoo.linkpc.net/9091092092099/The-Goblin-Emperor-by-Katherine-Addison.pdf
    • http://loaminoo.linkpc.net/2095090098098/The-Goblin-Reservation-by-Clifford-D-Simak.pdf
    • http://loaminoo.linkpc.net/1091097091094091095/The-Amazing-Spider-Man-A-New-Goblin-by-Len-Wein.pdf
    • http://loaminoo.linkpc.net/3096091098099099/The-Princess-and-the-Goblin-by-George-MacDonald.pdf
    • http://loaminoo.linkpc.net/5096096098098091/The-Princess-and-the-Goblin-by-George-MacDonald.pdf
    • http://loaminoo.linkpc.net/1099097093090096/The-Princess-and-the-Goblin-by-George-MacDonald.pdf
    • http://loaminoo.linkpc.net/1096096095092093/Aster-Wood-and-the-Lost-Maps-of-Almara-Aster-Wood-1-by-J-B-Cantwell.pdf
    • http://loaminoo.linkpc.net/4098092090090092/Aster-Wood-and-the-Lost-Maps-of-Almara-Aster-Wood-1-by-J-B-Cantwell.pdf
    • http://loaminoo.linkpc.net/2093099097099091/The-Goblin-Brothers-Adventures-by-Lindsay-Buroker.pdf
    • http://loaminoo.linkpc.net/8092097095092/Goblin-Market-and-Other-Poems-by-Christina-Rossetti.pdf
    • http://loaminoo.linkpc.net/2095090098098/The

Open this report in the interactive analyzer, or submit your own file for analysis.