Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fdd207996c40b19…

MALICIOUS

PDF

14.0 KB Created: 2019-04-30 11:19:38 +01:00 Authoring application: mPDF 5.7
MD5: 2b10b1fdf3cc8bfd7062a6ec3a36da6b SHA-1: 1d22623fbbdede8aa708551aef77322080ae67f1 SHA-256: 3fdd207996c40b19e5d81de4f0f90a2a7f474dcc75915eac220a516cc2c2488f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. It contains a large number of embedded links to external PDF files hosted on 'loaminoo.linkpc.net', suggesting a link farm or distribution mechanism. While no scripts were extracted, the sheer volume of links and the ML classification indicate a malicious intent, likely to lure users to malicious content or for SEO poisoning.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091098092099096091/Home-is-Where-the-Art-is-by-Ellis-Major.pdf
    • http://loaminoo.linkpc.net/1091098093090093097/Our-Love-is-Here-to-Stay-by-Ellis-Major.pdf
    • http://loaminoo.linkpc.net/6090098096093099/Norfolk-Broads-The-Broads-Norfolk-Wherry-Breydon-Water-Halvergate-Marshes-River-Yare-River-Waveney-Aeshna-Isoceles-Martham-Broad-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/1091098093090093094/Blood-Loyal-Charlie-Tiptree-Book-10-by-Ellis-Major.pdf
    • http://loaminoo.linkpc.net/7096097098096095/Anansi-Time-with-Bobby-Norfolk-by-Bobby-Norfolk.pdf
    • http://loaminoo.linkpc.net/4091096096092097/Lullaby-Lullaby-1-by-Rebecca-Salas.pdf
    • http://loaminoo.linkpc.net/1091093091093092/Lempri-re-s-Dictionary-by-Lawrence-Norfolk.pdf
    • http://loaminoo.linkpc.net/8096097096097099/Englische-Landschaften---Unterwegs-in-Suffolk-und-Norfolk-by-Peter-Sager.pdf
    • http://loaminoo.linkpc.net/3096095094097096/The-Last-Lullaby-The-Spellsinger-1-by-Amy-Sumida.pdf
    • http://loaminoo.linkpc.net/3092097097093/This-Lullaby-by-Sarah-Dessen.pdf
    • http://loaminoo.linkpc.net/3093098099093091/This-Lullaby-by-Sarah-Dessen.pdf
    • http://loaminoo.linkpc.net/3093093091090095/Lullaby-by-Chuck-Palahniuk.pdf
    • http://loaminoo.linkpc.net/4090095090/The-Lullaby-Sky-by-Carolyn-Brown.pdf
    • http://loaminoo.linkpc.net/1090096091092095/Lullaby-The-Sand-Maiden-1-by-L-R-W-Lee.pdf
    • http://loaminoo.linkpc.net/4096091096091099/Cowboy-Lullaby-by-Lisa-Gray.pdf
    • http://loaminoo.linkpc.net/1091094095097097090/The-Lullaby-Shepherds-by-Barbara-Eisenhardt.pdf
    • http://loaminoo.linkpc.net/1090094097096097/Deadly-Lullaby-by-Robert-McClure.pdf
    • http://loaminoo.linkpc.net/8090097093094/Lullaby-87th-Precinct-41-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/4091097097094093/The-Mermaid-s-Lullaby-by-Kate-Spohn.pdf
    • http://loaminoo.linkpc.net/7090094091098/Hush-A-Thai-Lullaby-by-Minfong-Ho.pdf
    • http://loaminoo.linkpc.net/30920970970

Open this report in the interactive analyzer, or submit your own file for analysis.