Malicious PDF — malware analysis report

Static analysis result for SHA-256 e511a665431ab4e0…

MALICIOUS

PDF

15.5 KB Created: 2019-05-02 01:30:24 +01:00 Authoring application: mPDF 5.7
MD5: 12a18b7e48250af635bcca56d707ae8b SHA-1: b4f3a059933a8874f2dec5edb10daa025069e737 SHA-256: e511a665431ab4e07f538b9f64a1f44d63d31fa57ba595ffa882b3d4ebfded2f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to external PDF documents. While the specific URLs appear to link to book titles, the sheer volume and the ML classifier's high confidence score suggest a malicious intent, likely for SEO poisoning or to distribute further malicious content. No scripts were extracted, and the document body was not readable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1094096097094091/Wicked-Favor-The-Wicked-Horse-Vegas-1-by-Sawyer-Bennett.pdf
    • http://loaminoo.linkpc.net/3092096097090095/Wicked-Lust-The-Wicked-Horse-2-by-Sawyer-Bennett.pdf
    • http://loaminoo.linkpc.net/1093094093/Wicked-Fall-The-Wicked-Horse-1-by-Sawyer-Bennett.pdf
    • http://loaminoo.linkpc.net/3098093097090093/Wicked-Bond-The-Wicked-Horse-5-by-Sawyer-Bennett.pdf
    • http://loaminoo.linkpc.net/3094091096094099/Wicked-Need-The-Wicked-Horse-3-by-Sawyer-Bennett.pdf
    • http://loaminoo.linkpc.net/3095096097096098/Pure-Wicked-Wicked-Lovers-9-5-1001-Dark-Nights-25-by-Shayla-Black.pdf
    • http://loaminoo.linkpc.net/3090099099090090/The-Wicked-Years-Complete-Collection-Wicked-Son-of-a-Witch-A-Lion-Among-Men-and-Out-of-Oz-by-Gregory-Maguire.pdf
    • http://loaminoo.linkpc.net/3095097097090093/Wicked-The-Life-and-Times-of-the-Wicked-Witch-of-the-West-by-Gregory-Maguire.pdf
    • http://loaminoo.linkpc.net/1094094095094/The-Wicked-Wicked-Ladies-in-the-Haunted-House-by-Mary-Chase.pdf
    • http://loaminoo.linkpc.net/4099091099097094/Wicked-2-Legacy-amp-Spellbound-Wicked-3-4-by-Nancy-Holder.pdf
    • http://loaminoo.linkpc.net/1097091091095096/Wicked-Desires-Wicked-Affairs-1-by-Eliza-Lloyd.pdf
    • http://loaminoo.linkpc.net/3099090096090095/Lady-Gone-Wicked-Wicked-Secrets-2-by-Elizabeth-Bright.pdf
    • http://loaminoo.linkpc.net/1094098096097099/Wicked-The-Complete-Series-Wicked-1-4-by-Lily-Graison.pdf
    • http://loaminoo.linkpc.net/2099095091094092/Every-Witch-Way-But-Wicked-Wicked-Witches-of-the-Midwest-2-by-Amanda-M-Lee.pdf
    • http://loaminoo.linkpc.net/4095095093092091/Wicked-Lies-Wicked-2-Colony-4-by-Lisa-Jackson.pdf
    • http://loaminoo.linkpc.net/2090091093093092/Wicked-My-Love-Wicked-Little-Secrets-2-by-Susanna-Ives.pdf
    • http://loaminoo.linkpc.net/2094094099093094/Wicked-Beast-Wicked-Ever-After-2-by-Nazarea-Andrews.pdf
    • http://loaminoo.linkpc.net/2090092095093091/Wicked-Beautiful-Wicked-Games-1-by-J-T-Geissinger.pdf
    • http://loaminoo.linkpc.net/3095098092093093/Wicked-A-Wicked-Trilogy-1-by-Jennifer-L-Armentrout.pdf
    • http://loaminoo.linkpc.net/2092090093095091/Wicked-Solutions-Wicked-s-Way-1-by-Havan-Fellows.pdf
    • http://loaminoo.linkpc.net/4099091099097094

Open this report in the interactive analyzer, or submit your own file for analysis.