Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bdf9cc5276ff5e5…

MALICIOUS

PDF

16.7 KB Created: 2019-05-04 13:30:57 +01:00 Authoring application: mPDF 5.7 First seen: 2021-10-12
MD5: f09b9290f50266423684c571135bf1ad SHA-1: 752c088415aba9db4923730c1d70a10a8fb893c0 SHA-256: 3bdf9cc5276ff5e51589e3110647d5fa8b3a97273955d9af179ff4cd1895b047
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files hosted on the dynamic DNS domain 'loaminoo.linkpc.net'. This heuristic firing indicates a link farm or SEO poisoning attempt, designed to drive traffic to these external resources. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9913

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6096096097093090/Schubert-by-George-R-Marek.pdf In PDF document text
    • http://loaminoo.linkpc.net/8095094091099096/Beethoven-Biography-of-a-Genius-by-George-R-Marek.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6096096097096099/The-Curator-s-Egg-The-Evolution-of-the-Museum-Concept-from-the-French-Revolution-to-the-Present-Day-Karsten-Schubert-by-Karsten-Schubert.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1095091094092091/Mary-of-Nazareth-by-Marek-Halter.pdfIn PDF document text
    • http://loaminoo.linkpc.net/3092090090095094/The-Ghetto-Fights-by-Marek-Edelman.pdfIn PDF document text
    • http://loaminoo.linkpc.net/7092095097093094/Yoo-Retoont-Sneogg-Ay-Noo-by-Marek-S-Huberath.pdfIn PDF document text
    • http://loaminoo.linkpc.net/4098097091099094/The-Story-of-My-Baldness-by-Marek-van-der-Jagt.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1091095090097090096/Messerschmitt-Me-262-Schwalbe-Volume-2-by-Marek-J-Murawski.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1090090096096097091/Nachtfahrt-5-Minuten-Kurzgeschichte-zur-Nacht-by-Marek-Weborg.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1091092097095098099/Polska-Ukraina--Trudne-Pytania-Historia-Kultura-Gwara-by-Marek-Szotysek.pdfIn PDF document text
    • http://loaminoo.linkpc.net/2094095095091096/Anna-Mackowiak-amp-Marek-Olszewski---The-Polish-Dentist-who-pulled-all-her-Ex-s-Teeth-out-by-Maia-Anne-Fisher.pdfIn PDF document text
    • http://loaminoo.linkpc.net/9097092098094091/A-Cold-Blooded-Business-Adultery-Murder-and-a-Killer-s-Path-from-the-Bible-Belt-to-the-Boardroom-by-Marek-Fuchs.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6096096098095099/There-s-Always-Room-for-One-More-by-Ingrid-Schubert.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6096096098091095/Opposites-by-Ingrid-Schubert.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6096096098091093/Schubert-by-Peggy-Woodford.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6096096097094090/Schubert-by-Percy-M-Young.pdfIn PDF document text
    • http://loaminoo.linkpc.net/7096095092097092/Mass-in-F-by-Franz-Schubert.pdfIn PDF document text
    • http://loaminoo.linkpc.net/6096096098091099/Brothers-Schubert-by-Jerry-Stagg.pdfIn PDF document text
    • http://loaminoo.linkpc.net/9093098097098096/Rauber-Und-Gendarm-by-Ulli-Schubert.pdfIn PDF document text
    • http://loaminoo.linkpc.net/1090098096093098097/Sicherheit-und-Risiko-in-Fels-und-Eis-01-by-Pit-Schubert.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.