Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee64e4242c739a00…

MALICIOUS

PDF

17.1 KB Created: 2019-05-07 05:10:35 +01:00 Authoring application: mPDF 5.7
MD5: 0bd2a9e829e3b390648aee72d46c15f0 SHA-1: f058fa014047c332a3841887d482b80a2162b6ea SHA-256: ee64e4242c739a0085d69af60738b8273a0bbccd4813a4049d33aecffe2caa23
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various book titles hosted on loaminoo.linkpc.net. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a link farm designed to direct users to potentially malicious content. The ML_NYX_PDF_MALICIOUS classifier also flagged this PDF with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4098098098096092/Monty-Python-s-The-Life-Of-Brian-by-Graham-Chapman.pdf
    • http://loaminoo.linkpc.net/3094092096092099/Monty-Python-and-the-Holy-Grail-Screenplay-by-Graham-Chapman.pdf
    • http://loaminoo.linkpc.net/9090099094091/Monty-Python-s-Flying-Circus-Just-The-Words---Volumes-1-amp-2-by-Graham-Chapman.pdf
    • http://loaminoo.linkpc.net/2093091090099097/Monty-Python-s-Tunisian-Holiday-My-Life-with-Brian-by-Kim-Howard-Johnson.pdf
    • http://loaminoo.linkpc.net/5092094092092/A-Liar-s-Autobiography-Volume-VI-by-Graham-Chapman.pdf
    • http://loaminoo.linkpc.net/1091097092095099093/Python-Data-Analytics-Data-Analysis-and-Science-Using-Pandas-Matplotlib-and-the-Python-Programming-Language-by-Fabio-Nelli.pdf
    • http://loaminoo.linkpc.net/3096094093093096/Love-as-a-Way-of-Life-Seven-Keys-to-Transforming-Every-Aspect-of-Your-Life-by-Gary-Chapman.pdf
    • http://loaminoo.linkpc.net/3091090090099091/An-Appetite-for-Crime---The-Memoirs-of-Former-Detective-Superintendent-Ron-Chapman-by-Ron-Chapman.pdf
    • http://loaminoo.linkpc.net/6092098098097/The-Life-and-Times-of-James-Walter-Chapman-Taylor-by-Judy-Siers.pdf
    • http://loaminoo.linkpc.net/2095098097090/The-Facts-of-Life-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/1095099094094093/The-Facts-of-Life-A-Novel-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/1097097097092098/Life-After-Death-A-Romance-Suspense-by-T-J-Graham.pdf
    • http://loaminoo.linkpc.net/3091095099093092/Monty-and-Me-by-Louisa-Bennet.pdf
    • http://loaminoo.linkpc.net/4092098092098093/Nell-Gwynne-A-Passionate-Life-by-Graham-Hopkins.pdf
    • http://loaminoo.linkpc.net/8093094098095094/Memoirs-Of-The-Life-Of-Nicholas-Poussin-by-Maria-Graham.pdf
    • http://loaminoo.linkpc.net/1098095091095097/Monty-the-fish-goes-to-the-Zoo-by-Vivienne-Alonge.pdf
    • http://loaminoo.linkpc.net/1097092090091091/The-Full-Monty-by-Wendy-Holden.pdf
    • http://loaminoo.linkpc.net/1091098092090093090/Nigel-My-Family-and-Other-Dogs-by-Monty-Don.pdf
    • http://loaminoo.linkpc.net/1096095091096/The-Life-of-Graham-Greene-Vol-1-1904-1939-by-Norman-Sherry.pdf
    • http://loaminoo.linkpc.net/4094091096095098/Wild-Tales-A-Rock-amp-Roll-Life-by-Graham-Nash.pdf
    • http://loaminoo.linkpc.net/3091090

Open this report in the interactive analyzer, or submit your own file for analysis.