Malicious PDF — malware analysis report

Static analysis result for SHA-256 32406b6592d225cf…

MALICIOUS

PDF

16.2 KB Created: 2019-04-30 04:07:24 +01:00 Authoring application: mPDF 5.7
MD5: b3bf39d8e8ebcd1e536fde79aab9bccf SHA-1: e6ba7b4fc2e487307c396f6c45ad7111e728d3bf SHA-256: 32406b6592d225cff96db1c9fe74c722c3fdc410b853757a366da240043db390
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which are disguised as book titles. These links all point to the same domain, loaminoo.linkpc.net, suggesting a link farm or redirection scheme. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7097090090095090/Theodora-of-Constantinople-by-Elizabeth-Elson.pdf
    • http://loaminoo.linkpc.net/9098099097095/The-Tapestry-Shop-by-Joyce-Elson-Moore.pdf
    • http://loaminoo.linkpc.net/1098099099096098/Powerful-Prayers-in-the-War-Room-Learning-to-Pray-like-a-Powerful-Prayer-Warrior-Battle-Plan-for-Prayer-Book-1-by-Daniel-B-Lancaster.pdf
    • http://loaminoo.linkpc.net/4091098092096096/Hans-amp-Greta-a-Twisted-Fairy-Tale-Novella-by-Nicki-Elson.pdf
    • http://loaminoo.linkpc.net/5091097091094096/Paradox-Lost-A-Cross-Contextual-Definition-of-Levels-of-Abstraction-by-Linda-G-Elson.pdf
    • http://loaminoo.linkpc.net/9093091096095090/Kabbalah-and-Art-by-L-o-Bronstein.pdf
    • http://loaminoo.linkpc.net/6094091098096093/A-New-Kabbalah-for-Women-by-Perle-Besserman.pdf
    • http://loaminoo.linkpc.net/1091095090094098/Kabbalah-in-Art-and-Architecture-by-Alexander-Gorlin.pdf
    • http://loaminoo.linkpc.net/6091099096092/Studies-in-Ecstatic-Kabbalah-by-Moshe-Idel.pdf
    • http://loaminoo.linkpc.net/6094091097097096/Kabbalah-The-Way-of-The-Jewish-Mystic-by-Perle-Besserman.pdf
    • http://loaminoo.linkpc.net/1097098090098097/Kabbalah-Key-to-Your-Inner-Power-by-Elizabeth-Clare-Prophet.pdf
    • http://loaminoo.linkpc.net/5094091096090/Absorbing-Perfections-Kabbalah-and-Interpretation-by-Moshe-Idel.pdf
    • http://loaminoo.linkpc.net/1090092092092091096/The-Kabbalah-A-Jewish-Mystical-Path-by-Franjo-Terhart.pdf
    • http://loaminoo.linkpc.net/1091098098096095090/Gnosis-of-the-Cosmic-Christ-A-Gnostic-Christian-Kabbalah-by-Tau-Malachi.pdf
    • http://loaminoo.linkpc.net/4099092099096099/The-Way-Using-the-Wisdom-of-Kabbalah-for-Spiritual-Transformation-and-Fulfillment-by-Michael-Berg.pdf
    • http://loaminoo.linkpc.net/1091099095091097097/Shulamit-by-Kate-Miellas.pdf
    • http://loaminoo.linkpc.net/1091099095092098097/Murder-at-the-Minyan-by-Shulamit-E-Kustanowitz.pdf
    • http://loaminoo.linkpc.net/1091099095093096094/Psychiatry-in-Transition-by-Shulamit-Ramon.pdf
    • http://loaminoo.linkpc.net/9094099094091091/Valley-of-Strength-by-Shulamit-Lapid.pdf
    • http://loaminoo.linkpc.net/1091099095093095096/Petra-If-the-Stones-Could-Speak-by-Shulamit-Goldberger.pdf
    • http://loaminoo.linkpc.net/6094091097097096/Kabbalah-The-Way-of-The-Jewish-Mystic-by-Perle-Bes

Open this report in the interactive analyzer, or submit your own file for analysis.