Malicious PDF — malware analysis report

Static analysis result for SHA-256 e600986232e30f4c…

MALICIOUS

PDF

15.8 KB Created: 2019-05-04 14:42:53 +01:00 Authoring application: mPDF 5.7
MD5: 00da7406b1cd4a69234433377eedda8f SHA-1: 3e5d74ca557ed292725529ecfd40aead11595a9a SHA-256: e600986232e30f4c7261a20853a6bffe9dfd3d57bff2361dcdca3c9e97a7a0cf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm with 22 external PDF links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. The embedded URLs, while many are marked benign, are part of a pattern designed to direct users to a large number of external resources, likely for SEO manipulation or to host malicious content disguised as legitimate documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2092096090095091/A-Sandhills-Reader-30-Years-of-Great-Writing-from-the-Great-Plains-by-Ted-Kooser.pdf
    • http://loaminoo.linkpc.net/1091097094094091094/Computerized-Accounting-Using-Great-Plains-Dynamic-by-Arens.pdf
    • http://loaminoo.linkpc.net/8095093098090099/A-Cowboy-for-Caleb-Great-Plains-Shifters-1-by-L-C-Davis.pdf
    • http://loaminoo.linkpc.net/3092094090093/My-ntonia-Great-Plains-Trilogy-3-by-Willa-Cather.pdf
    • http://loaminoo.linkpc.net/2093095096094/Where-the-Buffalo-Roam-Restoring-America-s-Great-Plains-by-Anne-Matthews.pdf
    • http://loaminoo.linkpc.net/5090098099096/The-Nature-of-the-Place-A-Study-of-Great-Plains-Fiction-by-Diane-Dufva-Quantic.pdf
    • http://loaminoo.linkpc.net/4092091090096092/Quest-for-Quivira-Spanish-Explorers-on-the-Great-Plains-1540-1821-by-Thomas-E-Ch-vez.pdf
    • http://loaminoo.linkpc.net/5096098094092090/My-Tiny-Vegas-Life-Between-the-Sangre-de-Christo-Mountains-and-the-Great-Plains-by-Birdie-Jaworski.pdf
    • http://loaminoo.linkpc.net/4092090095095095/The-Mystic-Warriors-of-the-Plains-The-Culture-Arts-Crafts-and-Religion-of-the-Plains-Indians-by-Thomas-E-Mails.pdf
    • http://loaminoo.linkpc.net/2090091094096094/High-Plains-Promise-Love-on-the-High-Plains-2-by-Simone-Beaudelaire.pdf
    • http://loaminoo.linkpc.net/1094096098091093/High-Plains-Holiday-Love-on-the-High-Plains-1-by-Simone-Beaudelaire.pdf
    • http://loaminoo.linkpc.net/3094099091090/Preppy-by-T-M-Frazier.pdf
    • http://loaminoo.linkpc.net/4094096094090091/Falling-for-the-Deputy-by-Amy-Frazier.pdf
    • http://loaminoo.linkpc.net/7098095099/Varina-by-Charles-Frazier.pdf
    • http://loaminoo.linkpc.net/2092091091/Lawless-King-3-by-T-M-Frazier.pdf
    • http://loaminoo.linkpc.net/7095092099090/Tyrant-King-2-by-T-M-Frazier.pdf
    • http://loaminoo.linkpc.net/6090091096093/Return-to-Innocence-by-G-M-Frazier.pdf
    • http://loaminoo.linkpc.net/3095097094091098/Return-to-Innocence-by-G-M-Frazier.pdf
    • http://loaminoo.linkpc.net/2091097095094094/Travels-in-Siberia-by-Ian-Frazier.pdf
    • http://loaminoo.linkpc.net/2091097093094/Cold-Mountain-by-Charles-Frazier.pdf
    • http://loaminoo.linkpc.net/4092090095095095/The-Mystic-Warriors-of-the-Plains-The-Culture-Arts-Crafts-and-Religion-of-the-Plains-Indians-by-Thomas-E-Mails

Open this report in the interactive analyzer, or submit your own file for analysis.