Malicious PDF — malware analysis report

Static analysis result for SHA-256 378cde43b309afbf…

MALICIOUS

PDF

12.3 KB Created: 2019-04-30 04:24:30 +01:00 Authoring application: mPDF 5.7
MD5: a008d6b39f9d9a470926fbe9b613c73a SHA-1: daaf659521f074d982df230e6c4d96bc6f7893aa SHA-256: 378cde43b309afbfe879b437086addead3d578641eb1ec4f6a732639d0472a3b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files hosted on the domain 'loaminoo.linkpc.net'. This is indicative of a link farm or a redirection scheme designed to lead users to potentially malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8780

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1092094097098090/Leave-It-to-Psmith-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/3096096099090095/Psmith-Journalist-Psmith-3-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/1091092094091093/Mike-and-Psmith-Psmith-1-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/6099097098090/Psmith-in-the-City-Psmith-2-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/1099093090094097/Mike-and-Psmith-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/4092090094097091/Mike-Psmith-1-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/3097096093090099/Week-End-Wodehouse-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/4090091095092096/The-Most-of-P-G-Wodehouse-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/4099098094091/What-Ho-The-best-of-P-G-Wodehouse-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/3093094091092094/My-Man-Jeeves-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/3096099092098096/The-Ice-In-The-Bedroom-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/4093093090094095/Piccadilly-Jim-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/4090095099094092/The-Butler-Did-It-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/2098098094099091/Big-Money-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/8091093090091093/Jeeves-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/3095098091095098/The-Cat-Nappers-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/1098091094093/All-About-Jeeves-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/1093097099098093/Uneasy-Money-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/3097090096093098/Indiscretions-of-Archie-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/2098098096095090/The-Luck-of-the-Bodkins-by-P-G-Wodehouse.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.