Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0d78d20cb82d086…

MALICIOUS

PDF

15.9 KB Created: 2019-05-02 00:48:24 +01:00 Authoring application: mPDF 5.7
MD5: 223816bc60f152cf1fc63f5a1773f49b SHA-1: cd8be91a368a5d73cbe1e905a877acb9bdb2b9d7 SHA-256: e0d78d20cb82d08644e679abb724c34fddf41dcfcf0f10daf11d13c14c2d4e28
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently flagged as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to distribute further malware. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9892

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5091093097091092/Garry-Kasparov-on-My-Great-Predecessors-Part-1-by-Garry-Kasparov.pdf
    • http://loaminoo.linkpc.net/7097096098096/Garry-Kasparov-on-My-Great-Predecessors-Part-2-by-Garry-Kasparov.pdf
    • http://loaminoo.linkpc.net/1090092098094099096/Garry-Kasparov-on-Garry-Kasparov-Part-1-1973-1985-by-Garry-Kasparov.pdf
    • http://loaminoo.linkpc.net/5090096098091099/Kasparov-vs-Karpov-1975-1985-by-Garry-Kasparov.pdf
    • http://loaminoo.linkpc.net/5091093097091090/From-London-to-Elista-The-Inside-Story-of-the-World-Chess-Championship-Matches-That-Vladimir-Kramnik-Won-Against-Garry-Kasparov-Peter-Leko-and-Vesilin-Topalov-by-Evgeny-Bareev.pdf
    • http://loaminoo.linkpc.net/9093091094099095/The-World-Chess-Crown-Challenge-Kasparov-Vs-Karpov-Seville-87-by-David-Ionovich-Bronstein.pdf
    • http://loaminoo.linkpc.net/5091090092093/Under-God-by-Garry-Wills.pdf
    • http://loaminoo.linkpc.net/1092098091098094/A-Faith-Brief-by-Patrick-M-Garry.pdf
    • http://loaminoo.linkpc.net/9091091092091092/Just-a-Moment-by-Garry-Fricker.pdf
    • http://loaminoo.linkpc.net/1091096094097097/The-Illusion-by-Patrick-M-Garry.pdf
    • http://loaminoo.linkpc.net/2098099094094096/Ratface-by-Garry-Disher.pdf
    • http://loaminoo.linkpc.net/3098098094097092/No-Witnesses-to-Nothing-by-Garry-Rodgers.pdf
    • http://loaminoo.linkpc.net/2093096099093091/Snapshot-by-Garry-Disher.pdf
    • http://loaminoo.linkpc.net/7098095094095091/Why-Priests-by-Garry-Wills.pdf
    • http://loaminoo.linkpc.net/6097092090098090/Behavior-Modification-What-It-Is-And-How-To-Do-It-by-Garry-Martin.pdf
    • http://loaminoo.linkpc.net/3092099090097094/House-of-Tribes-by-Garry-Kilworth.pdf
    • http://loaminoo.linkpc.net/6097091099090095/Behavior-Modification-What-It-Is-and-How-to-Do-It-by-Garry-L-Martin.pdf
    • http://loaminoo.linkpc.net/2090091097096095/The-Princely-Flower-by-Garry-Kilworth.pdf
    • http://loaminoo.linkpc.net/1093090098092098/Happiness-for-Beginners-by-Garry-Lee-Wright.pdf
    • http://loaminoo.linkpc.net/3096094095099097/Frost-Dancers-by-Garry-Kilworth.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.