Malicious PDF — malware analysis report

Static analysis result for SHA-256 37dbd88e27a20b7c…

MALICIOUS

PDF

31.8 KB Created: 2019-04-30 02:53:35 +01:00 Authoring application: mPDF 5.7
MD5: c6effc49e19becf0ba4ab96f7d6202f8 SHA-1: 04f5da2b7f97c4ecdbf6105a8d3eaa1108cef628 SHA-256: 37dbd88e27a20b7c36049384efeaa3a44d2e86ccc73deca9ac3f6536f3e6d4d4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by a machine learning classifier as malicious and contains a large number of embedded external links. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, with the first URL being http://loaminoo.linkpc.net/1091097096093096099/Woerter-Und-Begriffe---Luecken-Im-Kindesalter-Verlust-Der-Gleichberechtigung-in-Beruf-Und-Gesellschaft-Auswertung-Eines-Worttests-Bei-Tuerkischen-Migrantenkindern-in-Der-Primarstufe---Vergleich-Mit-Nichtmigrierten-Kindern-Deutsche-Schueler-in-Der-B-by-Ender-Hepsoyler.pdf. This suggests the document's primary purpose is to distribute malicious links or engage in SEO manipulation, rather than delivering content directly.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9886

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091097096093096099/Woerter-Und-Begriffe---Luecken-Im-Kindesalter-Verlust-Der-Gleichberechtigung-in-Beruf-Und-Gesellschaft-Auswertung-Eines-Worttests-Bei-Tuerkischen-Migrantenkindern-in-Der-Primarstufe---Vergleich-Mit-Nichtmigrierten-Kindern-Deutsche-Schueler-in-Der-B-by-Ender-Hepsoyler.pdf
    • http://loaminoo.linkpc.net/1091093096092090091/Altern-ALS-Behinderung-in-Beruf-Und-Gesellschaft-Dreizehntes-Bad-Sodener-Geriatrisches-Gesprach-8-Mai-1981-by-Volkmar-Bohlau.pdf
    • http://loaminoo.linkpc.net/9094094093090099/Leben-Mit-Kindern-in-Einer-Veranderten-Welt-Einstellungen-Und-Lebensplanung-Von-Eltern-Im-Ost-West-Vergleich-Internationale-Texte-Band-5-by-Jurgen-Sass.pdf
    • http://loaminoo.linkpc.net/6092094099097094/Deutsche-Geographische-Blatter-1902-Vol-25-Herausgegeben-Von-Der-Geographischen-Gesellschaft-in-Bremen-by-A-Oppel.pdf
    • http://loaminoo.linkpc.net/1091096095097092094/Allgemeine-Deutsche-Naturhistorische-Zeitung-1855-Vol-1-Im-Auftrage-Der-Gesellschaft-Isis-in-Dresden-by-Adolph-Drechsler.pdf
    • http://loaminoo.linkpc.net/4096097097095/First-Meetings-in-Ender-s-Universe-Ender-s-Saga-0-5-by-Orson-Scott-Card.pdf
    • http://loaminoo.linkpc.net/9093091093095096/Billy-Budd-Vortoppmann-auf-der-Indomitable-Vollst-ndige-deutsche-Ausgabe-Die-Geschichte-eines-jungen-Matrosen-by-Herman-Melville.pdf
    • http://loaminoo.linkpc.net/6090093095091095/Ender-s-Game-Ender-s-Saga-1-by-Orson-Scott-Card.pdf
    • http://loaminoo.linkpc.net/1093096090092099/The-Ender-Quartet-Box-Set-The-Ender-Quintet-1-4-by-Orson-Scott-Card.pdf
    • http://loaminoo.linkpc.net/6096098096095/Ender-s-Game-Ender-s-Saga-1-by-Orson-Scott-Card.pdf
    • http://loaminoo.linkpc.net/2092098096099091/Beyond-Ender-s-Game-Speaker-for-the-Dead-Xenocide-Children-of-the-Mind-Ender-s-Saga-2-4-by-Orson-Scott-Card.pdf
    • http://loaminoo.linkpc.net/2092098097092094/Ender-s-War-The-Ender-Quintet-1-2-by-Orson-Scott-Card.pdf
    • http://loaminoo.linkpc.net/1091091096098099096/Elternschaft-Muttertag-Vater-Grosseltern-Vereinbarkeit-Von-Familie-Und-Beruf-Vereinbarkeit-Von-Familie-Und-Beruf-in-Einzelnen-Staaten-by-Quelle-Wikipedia.pdf
    • http://loaminoo.linkpc.net/8099095094096096/S-mtliche-Werke-Aus-dem-Tagebuch-eines-Hundes-Deutsche-Thesen-gegen-den-Papst-und-seine-Dunkelm-nner-Visionen-Das-Liebeskonzil-Genie-und-Wahnsinn-in-Tavistock-Square-by-Oskar-Panizza.pdf
    • http://loaminoo.linkpc.net/2092098097095094/The-Ender-Wiggin-Saga-Ender-s-Saga-1-3-by-Orson-Scott-Card.pdf
    • http://loaminoo.linkpc.net/8095097097097095/Solide-Maligne-Tumoren-Im-Kindesalter-by-E-Rossi.pdf
    • http://loaminoo.linkpc.net/1090095092098094096/Simpliciana-Schriften-Der-Grimmelshausen-Gesellschaft-XXII-2000---In-Verbindung-Mit-Dem-Vorstand-Der-Grimmelshausen-Gesellschaft-by-Dieter-Breuer.pdf
    • http://loaminoo.linkpc.net/1090095092098095090/Simpliciana-Schriften-Der-Grimmelshausen-Gesellschaft-XXVI-2004---In-Verbindung-Mit-Dem-Vorstand-Der-Grimmelshausen-Gesellschaft-by-Dieter-Breuer.pdf
    • http://loaminoo.linkpc.net/1090095092098095092/Simpliciana-Schriften-Der-Grimmelshausen-Gesellschaft-XXIX-2007---In-Verbindung-Mit-Dem-Vorstand-Der-Grimmelshausen-Gesellschaft-by-Dieter-Breuer.pdf
    • http://loaminoo.linkpc.net/1091098096090093094/Mittheilungen-Der-Anthropologischen-Gesellschaft-in-Wien-1882-Vol-11-Der-Neuen-Folge-I-Band-by-Anthropologische-Gesellschaft-in-Wien.pdf
    • http://loaminoo.linkpc.net/9094094093090099/Leben-Mit-Kindern-in-Einer-Veranderten-Welt-Eins

Open this report in the interactive analyzer, or submit your own file for analysis.