Malicious PDF — malware analysis report

Static analysis result for SHA-256 23d18e2c0ee6d466…

MALICIOUS

PDF

14.3 KB Created: 2019-04-30 05:05:36 +01:00 Authoring application: mPDF 5.7
MD5: 380ccb658dc848142c025ac3abec7bb6 SHA-1: e9ef16ba7d8e48d811dde89c3810b2c164d43f48 SHA-256: 23d18e2c0ee6d466da79e7a542297c0b738537fc974630c3c3cd00bf9649c016
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files hosted on the 'loaminoo.linkpc.net' domain. This is indicative of a link farm or SEO poisoning attack, designed to drive traffic to malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4095099099090095/Something-Big-Has-Been-Here-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/2093098094091099/Something-Big-Has-Been-Here-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/4098092097099097/It-s-Halloween-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/4095096090094099/Circus-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/5090091097095098/It-s-Christmas-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/4095099099090091/The-new-kid-on-the-block-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/3098094095091098/It-s-Christmas-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/8094099094095091/Brave-Little-Pete-of-Geranium-Street-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/1097098092090095/Pizza-Pigs-and-Poetry-How-to-Write-a-Poem-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/3091093092097093/The-Random-House-Book-of-Poetry-for-Children-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/4095099099090090/The-Beauty-of-the-Beast-Poems-from-the-Animal-Kingdom-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/1093095093097/Awful-Ogre-s-Awful-Day-by-Jack-Prelutsky.pdf
    • http://loaminoo.linkpc.net/3094095095091096/The-Dragons-of-Dorcastle-The-Pillars-of-Reality-1-by-Jack-Campbell.pdf
    • http://loaminoo.linkpc.net/2095094092098096/On-the-Accidental-Wings-of-Dragons-The-Dragons-of-Eternity-1-by-Julie-Wetzel.pdf
    • http://loaminoo.linkpc.net/1091096096094092/Love-in-the-Time-of-Dragons-Light-Dragons-1-by-Katie-MacAlister.pdf
    • http://loaminoo.linkpc.net/2098094093095095/The-Unbearable-Lightness-of-Dragons-Light-Dragons-2-by-Katie-MacAlister.pdf
    • http://loaminoo.linkpc.net/6093099094090096/Make-Way-for-Dragons-Dragons-Series-1-by-Thorarinn-Gunnarsson.pdf
    • http://loaminoo.linkpc.net/2092091091091097/The-Dragons-of-Chiril-Valley-of-the-Dragons-1-by-Donita-K-Paul.pdf
    • http://loaminoo.linkpc.net/2099095093095092/Dragons-Deal-Dragons-3-by-Robert-Lynn-Asprin.pdf
    • http://loaminoo.linkpc.net/6093099094096092/Dragons-on-the-Town-Dragons-Series-3-by-Thorarinn-Gunnarsson.pdf
    • http://loaminoo.linkpc.net/3

Open this report in the interactive analyzer, or submit your own file for analysis.