Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0c829008d791233…

MALICIOUS

PDF

16.5 KB Created: 2019-05-02 01:29:43 +01:00 Authoring application: mPDF 5.7
MD5: af3291c5b15d9f95585e40003e65a480 SHA-1: d89b2ecb091a73f6530f169185657892e359b5b5 SHA-256: e0c829008d791233e5309e4ac7894266fa7d59ecba0c4ea2c46d8419d3598d75
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the specific URLs are marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to distribute further payloads. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091096095094092099/How-to-be-Good-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/2096096090098097/How-to-Be-Good-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/2097093092094099/How-To-Be-Good-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/4090093098094/Slam-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/1090091093098092094/A-Long-Way-Down-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/1090091096093096093/A-Long-Way-Down-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/4091093091091092/Not-A-Star-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/4096098094090096/Fever-Pitch-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/7091096097094093/Everyone-s-Reading-Bastard-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/8091099094094096/Alta-fidelidade-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/3092095096096099/Not-a-Star-and-Otherwise-Pandemonium-Stories-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/3091094090096093/Not-a-Star-and-Otherwise-Pandemonium-Stories-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/1091090099096090093/Weniger-reden-und-fter-mal-in-die-Badewanne---Mein-Leben-als-Leser-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/2097091094099099/Books-Movies-Rhythm-Blues-Twenty-Years-of-Writing-About-Film-Music-and-Books-by-Nick-Hornby.pdf
    • http://loaminoo.linkpc.net/1093098093093097/Dino-Living-High-in-the-Dirty-Business-of-Dreams-by-Nick-Tosches.pdf
    • http://loaminoo.linkpc.net/9097094098098095/Nick-and-Tecla-s-High-Voltage-Danger-Lab-A-Mystery-with-Electromagnets-Burglar-Alarms-and-Other-Gadgets-You-Can-Build-Yourself-by-Pflugfelder.pdf
    • http://loaminoo.linkpc.net/8096092098094/Fidelity-Stories-by-Michael-Redhill.pdf
    • http://loaminoo.linkpc.net/1090094095097091090/Achieving-Higher-Fidelity-Conjunction-Analyses-Using-Cryptography-to-Improve-Information-Sharing-by-Brett-Hemenway.pdf
    • http://loaminoo.linkpc.net/1091096099098092097/Oxford-Advanced-Learner-s-Dictionary-by-A-S-Hornby.pdf
    • http://loaminoo.linkpc.net/7095097091094099/Toronto-and-the-Maple-Leafs-A-City-and-Its-Team-by-Lance-Hornby.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.