Malicious PDF — malware analysis report

Static analysis result for SHA-256 f335b65e4f4c0add…

MALICIOUS

PDF

29.4 KB Created: 2019-05-02 18:31:11 +01:00 Authoring application: mPDF 5.7
MD5: d426cbf1933dc02fa714b3a5ac116079 SHA-1: f9a0c0a5a3405add5ef9992a871c350662fc3c6f SHA-256: f335b65e4f4c0add49f97b35a8d8d3cf8833b1b44543fd6fb446d5fc959efdce
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the heuristic 'PDF_SEO_LINK_FARM' indicates a high likelihood of malicious intent through link manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9897

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8095095099090092/Much-Adoe-about-Nothing-Applause-First-Folio-Editions-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/8095095099093096/Julius-Caesar-First-Folio-Edition-First-Folio-Editions-Book-30-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/8095095098094097/Macbeth-The-First-Folio-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/8095095098098090/A-Midsommer-Nights-Dream-Folio-Text-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/4099092097095/The-Book-of-William-How-Shakespeare-s-First-Folio-Conquered-the-World-by-Paul-Collins.pdf
    • http://loaminoo.linkpc.net/8095095098093097/The-Tragedie-of-Romeo-and-Juliet-A-Frankly-Annotated-First-Folio-Edition-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5099097096095096/Pericles-Prince-of-Tyre-The-Players-Text-of-1609-with-the-Third-Folio-Text-of-1663-4-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/8098095098093091/The-Merchant-of-Venice-Junior-Certificate-English-A-Romantic-Comedy-by-William-Shakespeare-Folens-Shakespeare-Series-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/1091094099091097094/The-Complete-Works-of-William-Shakespeare-comprising-his-plays-and-poems-also-the-history-of-his-life-his-will-and-an-introduction-to-each-play-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5096090096099092/Hamlet-FREE-The-Tragedy-Of-Macbeth-By-William-Shakespeare-100-Formatted-Illustrated---JBS-Classics-100-Greatest-Novels-of-All-Time-Book-23-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5097097098098090/The-Complete-Works-of-William-Shakespeare-With-Historical-and-Analytical-Prefaces-Comments-Critical-and-Explanatory-Notes-Glossaries-a-Life-of-Sh-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/6090097098098091/Macbeth-Katharina-Thalbach-liest-William-Shakespeare-in-der-bersetzung-von-Thomas-Brasch-1-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/1090098091090098091/Richard-III-Katharina-Thalbach-liest-William-Shakespeare-in-der-bersetzung-von-Thomas-Brasch-5-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/2095092094092097/William-Shakespeare-s-Tragedy-of-the-Sith-s-Revenge-William-Shakespeare-s-Star-Wars-3-by-Ian-Doescher.pdf
    • http://loaminoo.linkpc.net/3090094092093096/William-Shakespeare-s-The-Force-Doth-Awaken-William-Shakespeare-s-Star-Wars-7-by-Ian-Doescher.pdf
    • http://loaminoo.linkpc.net/3096095099099092/William-Shakespeare-s-Tragedy-of-the-Sith-s-Revenge-William-Shakespeare-s-Star-Wars-3-by-Ian-Doescher.pdf
    • http://loaminoo.linkpc.net/1099091094096098/The-Complete-Works-of-William-Shakespeare-Illustrated-Inline-Footnotes-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/1091099091091092094/The-Printing-of-the-First-Folio-of-Shakespeare-by-Edwin-Eliott-Willoughby.pdf
    • http://loaminoo.linkpc.net/3097093097095094/Printing-and-Proofreading-of-the-First-Folio-of-Shakespeare-by-Charlton-Hinman.pdf
    • http://loaminoo.linkpc.net/1090098099094098091/Complete-Works-of-William-Shakespeare-154-Sonnets-Romeo-and-Juliet-Othello-Hamlet-Macbeth-Antony-and-Cleopatra-The-Tempest-Julius-Caesar-King-Cressida-The-Winter-s-Tale-amp-more-by-William-Shakespeare.pdf
    • http://loaminoo.linkpc.net/5099097096095096/Pericles-Prince

Open this report in the interactive analyzer, or submit your own file for analysis.