Malicious PDF — malware analysis report

Static analysis result for SHA-256 f92f3a825035c73f…

MALICIOUS

PDF

20.1 KB Created: 2019-05-02 02:25:06 +01:00 Authoring application: mPDF 5.7
MD5: f9c53b2d803639b65ca8a861d40ebd60 SHA-1: cce3973095e903704c4ee174729a5c603607172c SHA-256: f92f3a825035c73f0ea6b25207119e5a955b29ef83b8f2a30f73a63a19752590
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign-looking documents, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to distribute further malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5099091099095096/John-Stuart-Mill-De-la-libert-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/4094098096093/Utilitarianism-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/9098094099097096/Utilitarianism-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/8090090090093094/The-Subjection-of-Women-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/3099095091092097/On-Liberty-and-Utilitarianism-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/1090097097097091094/On-Liberty-annotated-and-illustrated-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/5092096096096099/On-Liberty-Audiobook-With-5-Bonus-Books-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/1091099094091096096/System-Der-Deductiven-Und-Inductiven-Logik-In-Zwei-Teilen-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/1091092090099092092/On-Liberty-A-Translation-into-Modern-English-ISR-Business-amp-the-political-legal-environment-studies-Book-6-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/8093095092095098/The-Subjection-of-Women---De-l-assujettissement-des-femmes-Bilingual-parallel-text---Bilingue-avec-le-texte-parall-le-English---French-Anglais---Fran-ais-Language-Easy-Reader-t-15-by-John-Stuart-Mill.pdf
    • http://loaminoo.linkpc.net/7092097099099098/The-ratmepper-of-Hamelin-by-John-O-39-Mill.pdf
    • http://loaminoo.linkpc.net/1090097093091093095/You-Wouldn-t-Want-to-Be-a-Victorian-Mill-Worker-A-Grueling-Job-You-d-Rather-Not-Have-by-John-Malam.pdf
    • http://loaminoo.linkpc.net/1096098093093091/John-Stuart-and-the-Southern-Colonial-Frontier-A-Study-of-Indian-Relations-War-Trade-Land-Problems-in-the-Southern-Wilderness-1754-1775-by-John-Richard-Alden.pdf
    • http://loaminoo.linkpc.net/6094092094097093/JOHN-FROM-DES-MOINES-OR-NOT-by-Michael-K-Stuart.pdf
    • http://loaminoo.linkpc.net/1098096095090098/The-Oxford-Illustrated-History-of-Tudor-amp-Stuart-Britain-by-John-Morrill.pdf
    • http://loaminoo.linkpc.net/1095090090091092/The-Royal-Road-to-Fotheringhay-Stuart-Saga-1-Mary-Stuart-1-by-Jean-Plaidy.pdf
    • http://loaminoo.linkpc.net/3094097096099/Overtime-Punchin-Out-with-the-Mill-Hunk-Herald-by-Mill-Hunk-Herald.pdf
    • http://loaminoo.linkpc.net/9099090099092/The-New-Deal-in-South-Florida-Design-Policy-and-Community-Building-1933-1940-by-John-A-Stuart.pdf
    • http://loaminoo.linkpc.net/4090093094095092/Mill-by-David-Macaulay.pdf
    • http://loaminoo.linkpc.net/1091099091094098095/The-Philosophy-of-J-S-Mill-by-R-P-Anschutz.pdf
    • http://loaminoo.linkpc.net/1091092090099092092/On-Liberty-A-Translation-in

Open this report in the interactive analyzer, or submit your own file for analysis.