Malicious PDF — malware analysis report

Static analysis result for SHA-256 332bd0ca83a27421…

MALICIOUS

PDF

12.7 KB Created: 2019-04-30 17:32:09 +01:00 Authoring application: mPDF 5.7
MD5: 364a59b81fc0ea395b256a038f4f82b1 SHA-1: 542361b91e0212e7652431fd70eaad356539aa97 SHA-256: 332bd0ca83a27421a13cbbf45258501dbfc4b24402ea3d2dcc127aabbdd13ce9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to malicious websites. The dominant host for these links is loaminoo.linkpc.net. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8780

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1099095098098093/Eon-Eon-1-by-Alison-Goodman.pdf
    • http://loaminoo.linkpc.net/3096093099099098/Eona-Eon-2-by-Alison-Goodman.pdf
    • http://loaminoo.linkpc.net/4091092091091094/Killing-the-Rabbit-by-Alison-Goodman.pdf
    • http://loaminoo.linkpc.net/3091094097094095/Eona-The-Last-Dragoneye-by-Alison-Goodman.pdf
    • http://loaminoo.linkpc.net/9092091092099/Singing-the-Dogstar-Blues-by-Alison-Goodman.pdf
    • http://loaminoo.linkpc.net/2093099098/The-Dark-Days-Club-Lady-Helen-1-by-Alison-Goodman.pdf
    • http://loaminoo.linkpc.net/9092090091/The-Dark-Days-Deceit-Lady-Helen-3-by-Alison-Goodman.pdf
    • http://loaminoo.linkpc.net/2095095093094098/Lady-Helen-and-the-Dark-Days-Club-Lady-Helen-1-by-Alison-Goodman.pdf
    • http://loaminoo.linkpc.net/7091090099096/Linda-Goodman-s-Relationship-Signs-by-Linda-Goodman.pdf
    • http://loaminoo.linkpc.net/3099095092094099/Scatter-My-Ashes-at-Bergdorf-Goodman-by-Bergdorf-Goodman.pdf
    • http://loaminoo.linkpc.net/4096098096093091/This-Gun-for-Hire-by-Jo-Goodman.pdf
    • http://loaminoo.linkpc.net/6097093090095/Intuition-by-Allegra-Goodman.pdf
    • http://loaminoo.linkpc.net/1091096094098095/In-the-Event-Of-by-Harvey-Goodman.pdf
    • http://loaminoo.linkpc.net/4090098096096098/How-to-be-a-Victorian-by-Ruth-Goodman.pdf
    • http://loaminoo.linkpc.net/1091098092095090093/Black-Sands-by-Carl-Goodman.pdf
    • http://loaminoo.linkpc.net/1094090098093095/The-Drowning-Tree-by-Carol-Goodman.pdf
    • http://loaminoo.linkpc.net/3093096091094094/The-Widow-s-House-by-Carol-Goodman.pdf
    • http://loaminoo.linkpc.net/7094093099091092/a-PUZZLED-EXISTENCE-by-Jason-P-Goodman.pdf
    • http://loaminoo.linkpc.net/4091092096099097/The-Devil-You-Know-McKenna-Brothers-2-by-Jo-Goodman.pdf
    • http://loaminoo.linkpc.net/1095097096092094/Paradise-Park-by-Allegra-Goodman.pdf
    • http://loaminoo.linkpc.net/6097093090095/Intuition-by-Allegra-Good

Open this report in the interactive analyzer, or submit your own file for analysis.