Malicious PDF — malware analysis report

Static analysis result for SHA-256 41c1affc510c5add…

MALICIOUS

PDF

15.0 KB Created: 2019-04-30 04:25:49 +01:00 Authoring application: mPDF 5.7
MD5: da15c2225cf6b90fc51309e073e7f40e SHA-1: 1a0c6ce706ef729c2f955a06c924e772d01e8ea9 SHA-256: 41c1affc510c5addbe57a29dbaeed6b98d9773a2a9115f3b3396faef60fbb2c3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or distribution mechanism. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were extracted, the sheer volume of links points to a malicious intent, likely to redirect users to malicious sites or to manipulate search engine results. The primary IOCs are the numerous URLs hosted on loaminoo.linkpc.net.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1095094095099091/The-Rook-The-Checquy-Files-1-by-Daniel-O-39-Malley.pdf
    • http://loaminoo.linkpc.net/1090094092090/The-Rook-The-Checquy-Files-1-by-Daniel-O-39-Malley.pdf
    • http://loaminoo.linkpc.net/3091093099090097/The-Rook-The-Checquy-Files-1-by-Daniel-O-39-Malley.pdf
    • http://loaminoo.linkpc.net/1093090095090099/The-Rook-The-Patrick-Bowers-Files-2-by-Steven-James.pdf
    • http://loaminoo.linkpc.net/1090094095092096094/The-X-Files-Cold-Cases-X-Files-1-by-Joe-Harris.pdf
    • http://loaminoo.linkpc.net/1092096096093096/I-Am-Number-Four-The-Lost-Files-Rebel-Allies-Lorien-Legacies-The-Lost-Files-10-12-by-Pittacus-Lore.pdf
    • http://loaminoo.linkpc.net/1090099095094092095/Rook-Sex-and-Bullets-3-by-Jo-Raven.pdf
    • http://loaminoo.linkpc.net/3091097094094/Rook-by-Anthony-McGowan.pdf
    • http://loaminoo.linkpc.net/2093096099094097/Run-Wild-Run-Free-by-David-Rook.pdf
    • http://loaminoo.linkpc.net/2091099099094091/Manic-Rook-and-Ronin-2-by-J-A-Huss.pdf
    • http://loaminoo.linkpc.net/8096093092094/Nearly-Departed-Weirdsville-1-by-Rook-Hastings.pdf
    • http://loaminoo.linkpc.net/3093092092092091/Red-Rook-Gailsone-2-by-Casey-Glanders.pdf
    • http://loaminoo.linkpc.net/9097099094092096/OWL-A-Winterling-story-about-Fer-and-Rook-by-Sarah-Prineas.pdf
    • http://loaminoo.linkpc.net/1094095098090096/Craving-U-The-Rook-Caf-1-by-Mirella-Muffarotto.pdf
    • http://loaminoo.linkpc.net/4094091091091/Side-Jobs-Stories-from-the-Dresden-Files-The-Dresden-Files-12-5-by-Jim-Butcher.pdf
    • http://loaminoo.linkpc.net/2096093092099097/Check-Mr-Rook-s-Island-3-by-Mimi-Jean-Pamfiloff.pdf
    • http://loaminoo.linkpc.net/2092095093094090/London-1850-Vampire-Plagues-1-by-Sebastian-Rook.pdf
    • http://loaminoo.linkpc.net/3095093095091094/Halos-and-Horns-About-Aiden-Rook-s-Demon-by-J-C-Holly.pdf
    • http://loaminoo.linkpc.net/2091093095093093/The-Edge-Chronicles-8-Vox-Second-Book-of-Rook-by-Paul-Stewart.pdf
    • http://loaminoo.linkpc.net/2096093091098097/Pawn-Mr-Rook-s-Island-2-by-Mimi-Jean-Pamfiloff.pdf
    • http://loaminoo.linkpc.net/2091099099094091/Manic-R

Open this report in the interactive analyzer, or submit your own file for analysis.