Malicious PDF — malware analysis report

Static analysis result for SHA-256 4be2ccaff16bd322…

MALICIOUS

PDF

14.6 KB Created: 2019-05-07 03:45:14 +01:00 Authoring application: mPDF 5.7
MD5: 026103045255a02a016d1dfa5c573a37 SHA-1: aa5f29ebbd9104f1b9cd6be8f3f819eb914dce4e SHA-256: 4be2ccaff16bd322aa56ec77b6e4db8706be207f2a30f81929a69ade04f47fee
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a PDF_SEO_LINK_FARM heuristic firing, indicating the presence of a mass external link farm. A total of 21 links were extracted, all pointing to the same domain, loaminoo.linkpc.net, with URLs structured as book titles. This suggests a tactic to lure users into clicking through to potentially malicious or deceptive content, possibly related to book piracy or phishing disguised as legitimate downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5098091093095/The-Gemini-Contenders-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/3098098099094090/The-Ambler-Warning-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/3092099097098090/Matarese-Circle-Uk-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/1092099091098090/The-Matarese-Circle-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/1090095094097092/The-Road-to-Gandolfo-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/3092094096098090/The-Osterman-Weekend-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/2095093094097093/Matarese-Circle-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/3099098096095097/The-Scorpio-Illusion-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/2090098099094094/The-Sigma-Protocol-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/2096093094094097/The-Moscow-Vector-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/1090094097099093/The-Holcroft-Covenant-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/3094099096099099/The-Hades-Factor-Covert-One-1-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/6097095098095090/The-Prometheus-Deception-The-Sigma-Protocol-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/2091093092095093/Robert-Ludlum-s-Hades-Factor-Covert-One-1-by-Gayle-Lynds.pdf
    • http://loaminoo.linkpc.net/3093095093093090/Robert-Ludlum-s-TM-The-Janus-Reprisal-Covert-One-9-by-Jamie-Freveletti.pdf
    • http://loaminoo.linkpc.net/2098097092098090/The-Bourne-Supremacy-Jason-Bourne-2-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/3092096091094/The-Bourne-Identity-Jason-Bourne-1-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/5096093094096/The-Bourne-Trilogy-Jason-Bourne-1-3-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/1092098090094098/Progression-A-Sara-Grey-Tale-by-Aaron-T-Brownell.pdf
    • http://loaminoo.linkpc.net/1091097090092091090/Logical-Progression-Using-Nonlinear-Periodization-for-Year-Round-Climbing-Performance-by-Steve-Bechtel.pdf
    • http://loaminoo.linkpc.net/3094099096099099/The-Hades-Factor-Covert-One-1-by-Robert-Lu

Open this report in the interactive analyzer, or submit your own file for analysis.