Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7a61434d07cb262…

MALICIOUS

PDF

12.4 KB Created: 2019-05-06 16:33:59 +01:00 Authoring application: mPDF 5.7
MD5: 1db87fdf175e583f815729a2d6da64bb SHA-1: aca990c34b3edb18f9c2f166c0912639f9095b43 SHA-256: e7a61434d07cb2621ac36098333118223311eb768bac59365b655be87cb658d0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier also flagged this PDF as malicious. The embedded URLs are the primary IOCs, directing users to a domain that appears to host a link farm. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8780

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5095094096091096/The-Peripheral-Novela-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/3098097092099092/The-Peripheral-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/1093098095091092/Neuromancer-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/2094091094099/Archangel-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/6092099095097/Neuromancer-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/3099098095094099/Burning-Chrome-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/2096094099098/Distrust-That-Particular-Flavor-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/3096095096099/The-Miracle-Worker-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/4093099091097094/The-Miracle-Worker-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/5097097090096093/Neuromancer-Sprawl-1-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/4096092098093090/All-Tomorrow-s-Parties-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/2094099096097/The-Winter-Market-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/6093094093093099/Neuromancer-PB-1984-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/3096095093095096/Idoru-Bridge-2-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/2094095099092/Neuromancer-Sprawl-1-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/3092098094094097/Burning-Chrome-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/4090099090094095/The-Miracle-Worker-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/2099090093091094/Neuromancer-Sprawl-Trilogy-1-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/3092098094094099/Count-Zero-Sprawl-Trilogy-2-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/2096097091098/Spook-Country-Blue-Ant-2-by-William-Gibson.pdf
    • http://loaminoo.linkpc.net/2094095099092/Neuromancer-Sprawl-1-by-Wi

Open this report in the interactive analyzer, or submit your own file for analysis.