Malicious PDF — malware analysis report

Static analysis result for SHA-256 254d6759b914f9df…

MALICIOUS

PDF

17.6 KB Created: 2019-05-02 18:52:44 +01:00 Authoring application: mPDF 5.7
MD5: 2768922e87dade5d83abdf1406feaf87 SHA-1: d94826b88edc576c35847c3c24e3f1e9cd76a41d SHA-256: 254d6759b914f9df3fd67defedccb458f2fdfb535eb378b0daead359aa85897e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDFs hosted on the domain loaminoo.linkpc.net. This is indicative of a link farm or SEO poisoning attack, designed to drive traffic to specific content. The ML classifier strongly flagged this PDF as malicious, and the heuristic rule PDF_SEO_LINK_FARM confirms the presence of a mass external link farm. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4091096097095091/The-Unannounced-Christmas-Visitor-by-Patrick-Higgins.pdf
    • http://loaminoo.linkpc.net/1099098095098/A-Queer-Reader-by-Patrick-Higgins.pdf
    • http://loaminoo.linkpc.net/5099094093093090/Kristan-Higgins-la-nouvelle-star-de-la-com-die-romantique-3-romans-by-Kristan-Higgins.pdf
    • http://loaminoo.linkpc.net/3097093092091095/Christmas-Proposals-Her-Christmas-Romeo-The-Tycoon-s-Christmas-Engagement-A-Bride-for-Christmas-by-Carole-Mortimer.pdf
    • http://loaminoo.linkpc.net/2092095091092099/A-Bride-By-Christmas-Home-For-Christmas-The-Wise-Virgin-Tumbleweed-Christmas-by-Heather-Graham.pdf
    • http://loaminoo.linkpc.net/3097094096092093/One-Christmas-Night-Highland-Christmas-A-Wife-For-Christmas-Ian-s-Gift-by-Ruth-Ryan-Langan.pdf
    • http://loaminoo.linkpc.net/7097093092/The-Visitor-by-K-L-Slater.pdf
    • http://loaminoo.linkpc.net/5090094099096091/Christmas-Once-Is-Christmas-Still-a-Christmas-Carol-with-Illustrations-by-Phillips-Brooks.pdf
    • http://loaminoo.linkpc.net/2090091098094096/The-Visitor-by-Valjeanne-Jeffers.pdf
    • http://loaminoo.linkpc.net/4096098095097099/The-Visitor-by-Evey-Brett.pdf
    • http://loaminoo.linkpc.net/5094094098093/The-Visitor-by-Sheri-S-Tepper.pdf
    • http://loaminoo.linkpc.net/3096098090093096/The-Visitor-and-Other-Threesomes-by-K-D-West.pdf
    • http://loaminoo.linkpc.net/2091098097099092/Visitor-in-Lunacy-by-Stephen-Curran.pdf
    • http://loaminoo.linkpc.net/6093098093096098/I-Am-a-Visitor-on-This-Earth-by-Faiza-Sultan.pdf
    • http://loaminoo.linkpc.net/2094092092091091/Night-Visitor-by-Roger-McKasson.pdf
    • http://loaminoo.linkpc.net/1091098097092097/The-Crimson-Key-The-Visitor-s-Series-2-by-Christy-Sloat.pdf
    • http://loaminoo.linkpc.net/1091097095092099/A-New-Birth-of-Freedom-The-Visitor-by-Robert-G-Pielke.pdf
    • http://loaminoo.linkpc.net/1091096090096096096/A-Visitor-s-Guide-to-Edinburgh-by-Irvine-Welsh.pdf
    • http://loaminoo.linkpc.net/2099096098/The-Visitor-Graveyard-Queen-4-by-Amanda-Stevens.pdf
    • http://loaminoo.linkpc.net/4096099097090091/Anne-Perry-s-Christmas-Vigil-A-Christmas-Promise-A-Christmas-Odyssey-Christmas-Stories-7-8-by-Anne-Perry.pdf
    • http://loaminoo.linkpc.net/709

Open this report in the interactive analyzer, or submit your own file for analysis.