Malicious PDF — malware analysis report

Static analysis result for SHA-256 311024ff536df32e…

MALICIOUS

PDF

16.5 KB Created: 2019-05-02 00:44:06 +01:00 Authoring application: mPDF 5.7
MD5: 20c645af047ae42b42e05cef438b92bf SHA-1: 169d901758c27ce08452f3a54dcbeb11ac2a8694 SHA-256: 311024ff536df32ee68f0d0404fd855631841d4e2844923ab408466b6cc858c1
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves directing users to a link farm hosted on loaminoo.linkpc.net, likely to distribute further malware or engage in phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6094095098099099/A-Crossworder-s-Holiday-Crossword-Mysteries-4-by-Nero-Blanc.pdf
    • http://loaminoo.linkpc.net/6094095098099098/Anatomy-Of-A-Crossword-Crossword-Mysteries-8-by-Nero-Blanc.pdf
    • http://loaminoo.linkpc.net/5096093098094094/Two-Down-Crossword-Mysteries-2-by-Nero-Blanc.pdf
    • http://loaminoo.linkpc.net/4098098093093098/A-Blanc-Christmas-by-Raymond-Blanc.pdf
    • http://loaminoo.linkpc.net/4096095093093099/Resorting-to-Murder-Holiday-Mysteries-by-Martin-Edwards.pdf
    • http://loaminoo.linkpc.net/5093091098093097/A-Dye-Hard-Holiday-Curl-Up-and-Dye-Mysteries-5-by-Aimee-Nicole-Walker.pdf
    • http://loaminoo.linkpc.net/3097094095097098/Wild-Holiday-Nights-Holiday-Rush-Playing-Games-All-Night-Long-by-Samantha-Hunter.pdf
    • http://loaminoo.linkpc.net/1090091097092097097/Haley-s-Hangdog-Holiday-Holiday-Inc-2-by-Tamie-Dearen.pdf
    • http://loaminoo.linkpc.net/1090090097099090094/Beginner-s-Crossword-Puzzle-Dictionary-by-Marjorie-Woolfolk.pdf
    • http://loaminoo.linkpc.net/6096093094095099/Holiday-Gift-Buying-Guide-2016-Over-35-Clean-YA-NA-Books-to-Complete-Your-Holiday-Shopping-Gift-List-by-Angel-Leya.pdf
    • http://loaminoo.linkpc.net/7093099096099093/Coeur-changeant---Roman-Holiday-saison-2---pisode-4-Roman-Holiday-T2-by-Ruthie-Knox.pdf
    • http://loaminoo.linkpc.net/6094095098099097/Gage-by-Cordelia-Blanc.pdf
    • http://loaminoo.linkpc.net/5095092090093094/La-femme-en-blanc-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/8093092093090095/Melvin-the-Mouth-by-Katherine-Blanc.pdf
    • http://loaminoo.linkpc.net/5098096098095092/The-Tour-Of-Mont-Blanc-by-Kev-Reynolds.pdf
    • http://loaminoo.linkpc.net/7092096096090092/l-organisation-du-travail-by-Louis-Blanc.pdf
    • http://loaminoo.linkpc.net/7092092092090090/Manchester-United-Crosswords-30-Original-Crossword-Puzzles---Totally-Devoted-to-United-by-Vahe-Ghevondyan.pdf
    • http://loaminoo.linkpc.net/5099095090095092/Frau-Blums-Rache-by-Esclave-Blanc.pdf
    • http://loaminoo.linkpc.net/1091097090091096092/Chambers-Crossword-Completer---New-Edition-by-Chambers-Dictionaries.pdf
    • http://loaminoo.linkpc.net/6098093091092096/Recipes-from-Le-Manoir-aux-Quat-Saisons-by-Raymond-Blanc.pdf
    • http://loaminoo.linkpc.net/6096093094095099/Holiday-Gift-Buying-Guide-2016-Over-35-Clean-YA-NA-Books-to-Complete-Your-Holiday-Shopping-Gift-List-by-Angel-Ley

Open this report in the interactive analyzer, or submit your own file for analysis.