Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6d45aa849ebb499…

MALICIOUS

PDF

18.6 KB Created: 2019-05-01 17:04:54 +01:00 Authoring application: mPDF 5.7
MD5: cde255fb91f805cbc75eb68f76ba95ab SHA-1: 624ace97e8f8ae837f545c3b164110ca47024d51 SHA-256: f6d45aa849ebb49995de3efd322729c5fddc0442892c2db448b964463e3b7afb
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier strongly indicated maliciousness. While no scripts were extracted, the PDF structure and embedded URLs suggest a delivery mechanism for further compromise, potentially leading to malware download or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9940

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.lin
    • http://loaminoo.linkpc.net/4090095096099098/Chobits-Omnibus-2-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/7097091090092/Chobits-Vol-8-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/7094097095090/Chobits-Vol-3-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/7098094090096/Chobits-Vol-7-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/7093098097096/Chobits-Vol-2-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/4091092099099099/Chobits-Boxed-Set-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/2097099098096096/Magic-Knight-Rayearth-Omnibus-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/4096095090097097/Magic-Knight-Rayearth-2-Omnibus-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/9092099096091099/Angelic-Layer-Omnibus-Edition-Vol-2-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/3098094098096090/Clamp-No-Kiseki-Volume-2-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/2093096091097094/Clamp-School-Detectives-Vol-01-CLAMP-School-Detectives-1-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/5090095094093099/Until-Death-Do-Us-Part-Omnibus-2-in-1-Edition-Vol-5-Includes-Vol-9-amp-10-Until-Death-Do-Us-Part-Omnibus-5-by-Hiroshi-Takashige.pdf
    • http://loaminoo.linkpc.net/5090093093090096/Kuroko-s-Basketball-Omnibus-Vol-1-Includes-Vols-1-amp-2-Kuroko-s-Basketball-Omnibus-1-by-Tadatoshi-Fujimaki.pdf
    • http://loaminoo.linkpc.net/5090095094098092/Until-Death-Do-Us-Part-Omnibus-2-in-1-Edition-Vol-8-Includes-Vol-15-amp-16-Until-Death-Do-Us-Part-Omnibus-8-by-Hiroshi-Takashige.pdf
    • http://loaminoo.linkpc.net/4096093097099097/Blood-Lad-Omnibus-Vol-7-Blood-Lad-Omnibus-7-by-Yuuki-Kodama.pdf
    • http://loaminoo.linkpc.net/4091093099097091/Wish-Vol-02-Wish-2-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/4096091098094095/Princess-Jellyfish-2-in-1-Omnibus-Volume-3-Princess-Jellyfish-2-in-1-Omnibus-3-by-Akiko-Higashimura.pdf
    • http://loaminoo.linkpc.net/5093096098093093/Princess-Jellyfish-2-in-1-Omnibus-Volume-8-Princess-Jellyfish-2-in-1-Omnibus-8-by-Akiko-Higashimura.pdf
    • http://loaminoo.linkpc.net/5093096097098091/Princess-Jellyfish-2-in-1-Omnibus-Volume-7-Princess-Jellyfish-2-in-1-Omnibus-7-by-Akiko-Higashimura.pdf
    • http://loaminoo.linkpc.net/2097096097090090/The-One-I-Love-by-CLAMP.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.