Malicious PDF — malware analysis report

Static analysis result for SHA-256 e76ff718262dbe55…

MALICIOUS

PDF

20.1 KB Created: 2019-05-01 17:06:49 +01:00 Authoring application: mPDF 5.7
MD5: 2c12d2cf3c1c75f94c98bd1ccea6ff05 SHA-1: 70b20c4e0c42d8bff14700fdff00acc94ea37740 SHA-256: e76ff718262dbe5515d89086819722e92ba83c5218ca71737455ad26c346e3f6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to external PDF documents. The ML classifier also flagged this file as malicious with high confidence. The embedded URLs, such as http://loaminoo.linkpc.net/5099090094094096/Eleanor-amp-Park-by-Rainbow-Rowell.pdf, are likely used to distribute further malicious content or to engage in SEO poisoning tactics to attract unsuspecting users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5099090094094096/Eleanor-amp-Park-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/6090095098099/Eleanor-amp-Park-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/7096091099092/Eleanor-amp-Park-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/3095090096099095/Eleanor-amp-Park-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/7096095092098093/Runaways-1-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/2095099094/Carry-On-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/2094099093097094/Landline-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/5092094090091/Fangirl-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/7097096097093/Carry-On-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/2091097099096093/Attachments-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/2095099096/Kindred-Spirits-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/5095098090/Carry-On-Simon-Snow-1-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/2096097097093092/The-Hyde-Park-Murder-Eleanor-Roosevelt-2-by-Elliott-Roosevelt.pdf
    • http://loaminoo.linkpc.net/3098097091093093/Eleanor-Jo-The-Farmer-s-Daughter-Eleanor-5-by-Eleanor-Clark.pdf
    • http://loaminoo.linkpc.net/1099093091092/Rainbow-Road-Rainbow-Trilogy-3-by-Alex-Sanchez.pdf
    • http://loaminoo.linkpc.net/2096095098098090/Acadia-National-Park-Motorists-Guide-Park-Loop-Road-by-Unknown.pdf
    • http://loaminoo.linkpc.net/1091097096094098093/Moderne-Im-Park-Der-Architekt-Helmut-Riemann-Und-Die-H-user-Im-Reemtsma-Park-In-Hamburg-by-Ulrich-H-hns.pdf
    • http://loaminoo.linkpc.net/6092096093090090/Park-s-Textbook-of-Preventive-and-Social-Medicine-by-K-Park.pdf
    • http://loaminoo.linkpc.net/9099090099097098/Hill-s-Wilmington-New-Hanover-County-N-C-City-Directory-1956-Including-Audubon-Devon-Park-Edgewood-Foxtown-Garden-City-Hanover-Heights-Highwood-Park-Idlewild-Longleaf-Hill-Oak-Court-Oak-Crest-Piney-Woods-and-Winter-Park-by-Hill-Directory-Company.pdf
    • http://loaminoo.linkpc.net/9099090099098090/Hill-s-Wilmington-New-Hanover-County-N-C-City-Directory-1958-Including-Audubon-Devon-Park-Edgewood-Foxtown-Garden-City-Hanover-Heights-Highwood-Park-Idlewild-Long-Leaf-Hill-Oak-Court-Oak-Crest-Piney-Woods-and-Winter-Park-by-Hill-Directory-Company.pdf
    • http://loaminoo.linkpc.net/2096095098098090/Acadia-National-Park-M

Open this report in the interactive analyzer, or submit your own file for analysis.