Malicious PDF — malware analysis report

Static analysis result for SHA-256 f03d008b810075ce…

MALICIOUS

PDF

19.4 KB Created: 2019-04-30 04:30:48 +01:00 Authoring application: mPDF 5.7
MD5: f55e7a6dd2646147e0345ab972337e91 SHA-1: 081d60506ad0418f23f35bd0034baba464b9a5ca SHA-256: f03d008b810075ce8bac596e43b4edfa0c27b3367e31ea57170d4bc8c3197b3e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the embedded URLs suggest a link farm designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7093094096095094/NEW-Eiken3-grade-at-the-top-speed-pass-NEW-Eiken3-grade-at-the-top-speed-pass-eiken3kyu-by-Takuji-Ekawa.pdf
    • http://loaminoo.linkpc.net/1093095091095096/Backstage-Pass-Last-Call-The-Backstage-Pass-Rock-Star-Romance-Book-6-by-Elizabeth-Nelson.pdf
    • http://loaminoo.linkpc.net/2091091092094093/100-Hikes-In-Washington-s-South-Cascades-And-Olympics-Chinook-Pass-White-Pass-Goat-Rocks-Mount-St-Helens-Mount-Adams-by-Ira-Spring.pdf
    • http://loaminoo.linkpc.net/1093095090098095/Backstage-Pass-Behind-the-Music-The-Backstage-Pass-Rock-Star-Romance-4-by-Elizabeth-Nelson.pdf
    • http://loaminoo.linkpc.net/8092093096095097/Common-Core-Math-Workbook-Grade-4-Free-Response-Daily-Math-Practice-Grade-4-by-Argo-Brothers.pdf
    • http://loaminoo.linkpc.net/1093095090090095/Backstage-Pass-V-I-P-The-Backstage-Pass-Rock-Star-Romance-2-by-Elizabeth-Nelson.pdf
    • http://loaminoo.linkpc.net/7093094095090098/Mastering-Camera-Shutter-Speed-Digital-Photography-Tips-and-Tricks-for-Beginners-on-How-to-Use-Fast-and-Slow-Shutter-Speed-for-Creative-Effect-by-Stephen-Hockman.pdf
    • http://loaminoo.linkpc.net/8092093091/The-Speed-of-Sound-Speed-of-Sound-Thrillers-1-by-Eric-Bernt.pdf
    • http://loaminoo.linkpc.net/8098095097090095/Grade-Booster-CfE-Higher-Chemistry-Grade-Booster-by-Leckie-amp-Leckie.pdf
    • http://loaminoo.linkpc.net/1099091095092094/Space-Station-Seventh-Grade-Space-Station-Seventh-Grade-1-by-Jerry-Spinelli.pdf
    • http://loaminoo.linkpc.net/2096095096094096/Before-They-Pass-Away-by-Jimmy-Nelson.pdf
    • http://loaminoo.linkpc.net/1091095090094097091/Pass-It-On-by-Marilyn-Sadler.pdf
    • http://loaminoo.linkpc.net/3091098092090/Acid-by-Emma-Pass.pdf
    • http://loaminoo.linkpc.net/5096097094095/So-Shall-We-Pass-by-Michael-Barrera.pdf
    • http://loaminoo.linkpc.net/5095094098092/Stumbling-in-the-Bloom-by-John-Pass.pdf
    • http://loaminoo.linkpc.net/5090092090092096/Harlan-s-Pass-by-Leona-Grace.pdf
    • http://loaminoo.linkpc.net/4090091092092094/Grants-Pass-by-Jennifer-Brozek.pdf
    • http://loaminoo.linkpc.net/3094092090092096/Pass-Interference-by-Natalie-Brock.pdf
    • http://loaminoo.linkpc.net/4098094093091093/Forward-Pass-by-Thomas-J-Dygard.pdf
    • http://loaminoo.linkpc.net/4098091096090095/Pass-the-Jam-Jim-Big-Book-by-Kaye-Umansky.pdf
    • http://loaminoo.linkpc.net/8092093096095097/Common-Core-Math-Workbook-Grade-4

Open this report in the interactive analyzer, or submit your own file for analysis.