Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ff1e063bc4a0cfb…

MALICIOUS

PDF

16.0 KB Created: 2019-05-01 19:40:13 +01:00 Authoring application: mPDF 5.7
MD5: cd085db5320209189f124062ebe89cc8 SHA-1: d8ba3dae9d07b1f3efb29d17d36b6641f2b628f8 SHA-256: 1ff1e063bc4a0cfb312a9f8aaa7517f05acd926eb20d107f7d17db4293d4dbd8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a PDF SEO link farm containing 22 external links, with the first being http://loaminoo.linkpc.net/7099098092091097/Larmes-am-res-dition-Canada-Monsters-in-the-Dark-T1-by-Pepper-Winters.pdf. This suggests the document is designed to redirect users to potentially harmful content, likely a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7099098092091097/Larmes-am-res-dition-Canada-Monsters-in-the-Dark-T1-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/3093093094/Je-Suis-Toi-Monsters-in-the-Dark-3-5-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/3097095099090/Tears-of-Tess-Monsters-in-the-Dark-1-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/8093093099095/Monsters-in-the-Dark-Monsters-in-the-Dark-1-3-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/2097092099092096/Destroyed-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/5090093090096091/Dollars-Dollar-2-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/8099090093099/Second-Debt-Indebted-3-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/1099090091096091/Hundreds-Dollar-3-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/4096093090090096/Hundreds-Dollar-3-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/2099097093098099/Pennies-Dollar-1-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/2096097093099098/The-Body-Painter-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/6093091098/Thousands-Dollar-4-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/8098095095090/Third-Debt-Indebted-4-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/3099095093099096/Debt-Inheritance-Indebted-1-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/2094099095/Sin-amp-Suffer-Pure-Corruption-MC-2-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/4091097092090/Debt-Inheritance-Indebted-1-by-Pepper-Winters.pdf
    • http://loaminoo.linkpc.net/5095091090093093/Larmes-Tome-1-Larmes-by-Lauren-Kate.pdf
    • http://loaminoo.linkpc.net/1090096099096091/Sense-and-Sensibility-and-Sea-Monsters-by-Ben-H-Winters.pdf
    • http://loaminoo.linkpc.net/6093099099092091/Canada-and-Aboriginal-Canada-Today---Le-Canada-Et-Le-Canada-Autochtone-Aujourdahui-Changing-the-Course-of-History---Changer-Le-Cours-de-Lahistoire-by-Paul-Martin.pdf
    • http://loaminoo.linkpc.net/7099098093093097/People-are-Seeing-Something-a-Survey-of-Lake-Monsters-in-the-United-States-and-Canada-by-Denver-Michaels.pdf
    • http://loaminoo.linkpc.net/60930

Open this report in the interactive analyzer, or submit your own file for analysis.