Malicious PDF — malware analysis report

Static analysis result for SHA-256 dacd311bd438b2bd…

MALICIOUS

PDF

14.9 KB Created: 2019-05-02 18:30:37 +01:00 Authoring application: mPDF 5.7
MD5: 267a3e5a09f68b876289caff27f954fe SHA-1: 29f2bd04c1124fcbdbc2a136631961bde910ba23 SHA-256: dacd311bd438b2bde676ab2395393bde061e2f5d76c84ed5e2fa9ab325fa5b6e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. While no scripts were extracted, the sheer volume of links and the heuristic firing suggest a malicious intent to redirect users to potentially harmful content hosted on loaminoo.linkpc.net.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3093091093090091/Swan-by-Frances-Mayes.pdf
    • http://loaminoo.linkpc.net/3094094097097/Under-the-Tuscan-Sun-by-Frances-Mayes.pdf
    • http://loaminoo.linkpc.net/7099092093/Women-in-Sunlight-by-Frances-Mayes.pdf
    • http://loaminoo.linkpc.net/1095099096097093/Bella-Tuscany-by-Frances-Mayes.pdf
    • http://loaminoo.linkpc.net/4092093093091098/Under-the-Tuscan-Sun-At-Home-in-Italy-by-Frances-Mayes.pdf
    • http://loaminoo.linkpc.net/8094090096092/A-Year-in-the-World-Journeys-of-a-Passionate-Traveller-by-Frances-Mayes.pdf
    • http://loaminoo.linkpc.net/3099093091092093/The-Discovery-of-Poetry-A-Field-Guide-to-Reading-and-Writing-Poems-by-Frances-Mayes.pdf
    • http://loaminoo.linkpc.net/5097094090095094/Saveurs-De-Toscane-by-Leslie-Forbes.pdf
    • http://loaminoo.linkpc.net/8094097090095093/Winnie-de-Poeh-amp-Het-huis-in-het-Poeh-hoekje-by-A-A-Milne.pdf
    • http://loaminoo.linkpc.net/7091093092091/The-Hambledown-Dream-by-Dean-Mayes.pdf
    • http://loaminoo.linkpc.net/4090095096094098/The-Regenesis-Cluster-by-Dean-Mayes.pdf
    • http://loaminoo.linkpc.net/4093091092099/Gifts-of-the-Peramangk-by-Dean-Mayes.pdf
    • http://loaminoo.linkpc.net/3098094095098091/Peril-A-Ger-Mayes-Thriller-by-Ruby-Barnes.pdf
    • http://loaminoo.linkpc.net/1093098092090092/Tinnitus-Treatment-Toolbox-A-Guide-for-People-with-Ear-Noise-by-J-L-Mayes.pdf
    • http://loaminoo.linkpc.net/5099093094098097/A-Little-Princess-By-Frances-Hodgson-Burnett---Illustrated-Comes-with-a-Free-Audiobook-by-Frances-Hodgson-Burnett.pdf
    • http://loaminoo.linkpc.net/5098097099095098/The-Secret-Garden-By-Frances-Hodgson-Burnett---Illustrated-by-Frances-Hodgson-Burnett.pdf
    • http://loaminoo.linkpc.net/6093094096092090/The-Secret-Garden-By-Frances-Hodgson-Burnett-Illustrated-by-Frances-Hodgson-Burnett.pdf
    • http://loaminoo.linkpc.net/1090095091090094098/Works-of-Frances-Hodgson-Burnett-by-Frances-Hodgson-Burnett.pdf
    • http://loaminoo.linkpc.net/1092099091091099/Frances-by-W-D-Valgardson.pdf
    • http://loaminoo.linkpc.net/1097095093093/The-Prowler-by-Frances-Rickett.pdf
    • http://loaminoo.linkpc.net/3098094095098091/Peril-A-Ger-Mayes-Thriller-by-Ruby-Barnes

Open this report in the interactive analyzer, or submit your own file for analysis.