Malicious PDF — malware analysis report

Static analysis result for SHA-256 43d8975a39945fe7…

MALICIOUS

PDF

14.7 KB Created: 2019-04-30 05:44:43 +01:00 Authoring application: mPDF 5.7
MD5: 2cc74122cf9de0566b60f9bc3b6861b8 SHA-1: 379a6ad5a97d1a323f6eb3fc32564d2d3018e102 SHA-256: 43d8975a39945fe7b0349acdd799851614d5a028ed527a26c19d777e1dcc4dcf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files, hosted on the domain 'loaminoo.linkpc.net'. This behavior is indicative of a link farm or a lure to download further malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3093095096/String-Theory-David-Foster-Wallace-on-Tennis-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/1090092092092095092/Consider-David-Foster-Wallace-by-David-Hering.pdf
    • http://loaminoo.linkpc.net/5093091094093097/The-Last-Interview-and-Other-Conversations-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/1097090091092095/The-Broom-of-the-System-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/5096090090093095/L-Infinie-com-die-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/2097091098091095/Oblivion-Stories-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/1097099093094097/Both-Flesh-and-Not-Essays-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/2099092098096091/Both-Flesh-and-Not-Essays-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/2098095093093098/Infinite-Jest-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/1093097093098098/Infinite-Jest-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/3098095094091/Consider-the-Lobster-and-Other-Essays-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/4090090090090090/The-Pale-King-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/1097099092090095/The-Legacy-of-David-Foster-Wallace-by-Samuel-Cohen.pdf
    • http://loaminoo.linkpc.net/3093096098092094/A-Supposedly-Fun-Thing-I-ll-Never-Do-Again-An-Essay-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/4092092094095096/Understanding-David-Foster-Wallace-by-Marshall-Boswell.pdf
    • http://loaminoo.linkpc.net/3095091098093/A-Supposedly-Fun-Thing-I-ll-Never-Do-Again-Essays-and-Arguments-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/6092090091096091/Freedom-and-the-Self-Essays-on-the-Philosophy-of-David-Foster-Wallace-by-Steven-M-Cahn.pdf
    • http://loaminoo.linkpc.net/6092090091099094/Fate-Time-and-Language-An-Essay-on-Free-Will-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/9097096097091090/Signifying-Rappers-Rap-and-Race-in-the-Urban-Present-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/1091092094091092099/Schrecklich-am-sant---aber-in-Zukunft-ohne-mich-by-David-Foster-Wallace.pdf
    • http://loaminoo.linkpc.net/3093096098092094/A-Supposedly-Fun-Thing-I-ll-Never-Do-Again-An-Essay

Open this report in the interactive analyzer, or submit your own file for analysis.