Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa95802efe8b6bff…

MALICIOUS

PDF

24.9 KB Created: 2019-04-30 05:46:08 +01:00 Authoring application: mPDF 5.7
MD5: f8ba656ad67d66367abc9178286e7fd1 SHA-1: 50fde086cb44a1db911fdb86525f22f1bd99b053 SHA-256: fa95802efe8b6bff7d56b43eabe929a32a7f16d76c9966b0db0c0fb20b044f92
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The document body contains numerous URLs pointing to a domain that appears to be used for hosting or redirecting to other PDF files, suggesting a link farm or content distribution network for malicious purposes. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc
    • http://loaminoo.linkpc.net/6093096090098091/My-Beloved-The-Story-of-a-Carmelite-Nun-by-Mother-Catherine-Thomas-of-Divine-Providence.pdf
    • http://loaminoo.linkpc.net/6093096091093092/My-Beloved-The-Story-of-a-Carmelite-Nun-by-Mother-Catherine-Thomas.pdf
    • http://loaminoo.linkpc.net/8092094090095095/L-homme-Sous-Le-Regard-De-La-Providence-Providence-De-Dieu-Et-Condition-Humaine-Selon-L-exposition-Litterale-Sur-Le-Livre-De-Job-De-Thomas-D-aquin-by-Denis-Chardonnens.pdf
    • http://loaminoo.linkpc.net/3097090098095090/The-Well-Beloved-with-The-Pursuit-of-the-Well-Beloved-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/8094095098096/Trustful-Surrender-to-Divine-Providence-The-Secret-of-Peace-and-Happiness-by-Jean-Baptiste-Saint-Jure.pdf
    • http://loaminoo.linkpc.net/3099093090095099/Divine-Secrets-Divine-and-Friends-3-by-Jacquelin-Thomas.pdf
    • http://loaminoo.linkpc.net/3099093090096093/Divine-Confidential-Divine-and-Friends-2-by-Jacquelin-Thomas.pdf
    • http://loaminoo.linkpc.net/6090095095095/A-Candle-in-the-Dark-Shewing-the-Divine-Cause-of-the-Distractions-of-the-Whole-Nation-of-England-and-of-the-Christian-World-By-Thomas-Ady-by-Thomas-Ady.pdf
    • http://loaminoo.linkpc.net/6092096095096099/UNDER-THE-GREENWOOD-TREE-by-Thomas-Hardy-author-of-Tess-of-the-d-Urbervilles-Far-From-the-Madding-Crowd-Jude-the-Obscure-The-Mayor-of-Casterbridge-The-Well-Beloved-Annotated-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/4097099096099097/The-Well-Beloved-by-Thomas-Hardy.pdf
    • http://loaminoo.linkpc.net/2092090093092095/Economics-of-Providence-L-Economie-de-La-Providence-Management-Finances-and-Patrimony-of-Religious-Orders-and-Congregations-in-Europe-1773-C-1930-by-Maarten-van-Dijck.pdf
    • http://loaminoo.linkpc.net/6093096091097094/Living-the-Carmelite-Way-The-Rule-for-the-Third-Order-of-Carmel-by-General-Curia-of-the-Carmelite-Order.pdf
    • http://loaminoo.linkpc.net/3098094098095094/Providence-Providence-1-by-Jamie-McGuire.pdf
    • http://loaminoo.linkpc.net/2098098090093093/Providence-Providence-1-by-Jamie-McGuire.pdf
    • http://loaminoo.linkpc.net/1090090099097095090/Divine-Friendship-According-to-St-Thomas-by-Jerome-Wilms.pdf
    • http://loaminoo.linkpc.net/2095093099094/Beloved-Stranger-Beloved-Trilogy-2-by-Patricia-Potter.pdf
    • http://loaminoo.linkpc.net/9099093093093095/A-Divine-Cordial-An-Exposition-of-Romans-8-28-by-Thomas-Watson.pdf
    • http://loaminoo.linkpc.net/9095097097090095/Best-Friends-The-True-Story-of-the-World-s-Most-Beloved-Animal-Sanctuary-by-Samantha-Glen.pdf
    • http://loaminoo.linkpc.net/4096090094092098/The-Doggie-in-the-Window-How-One-Beloved-Dog-Opened-My-Eyes-to-the-Complicated-Story-Behind-Man-s-Best-Friend-by-Rory-Kress.pdf
    • http://loaminoo.linkpc.net/5099093095097090/Sandro-Botticelli-The-Drawings-for-Dante-s-Divine-Comedy-by-Hein-Thomas-Schulze-Altcappenberg.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.