Malicious PDF — malware analysis report

Static analysis result for SHA-256 52f68e5ef6fba425…

MALICIOUS

PDF

12.6 KB Created: 2019-04-30 04:26:24 +01:00 Authoring application: mPDF 5.7
MD5: f5c8e457d09dbe81287b017e478a1e01 SHA-1: 7296fc71d42897281c5ea717f4975870f732eb22 SHA-256: 52f68e5ef6fba425483925b78a7dad7a03548df1e74b1479c43175ee6c3c34b1
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on the 'loaminoo.linkpc.net' domain. This is indicative of a link farm or SEO poisoning tactic, designed to drive traffic to a specific set of resources. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8780

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc
    • http://loaminoo.linkpc.net/9091098093096098/Enright-by-Mark-O-39-Sullivan.pdf
    • http://loaminoo.linkpc.net/3090094096098096/Ghost-Dance-by-Mark-T-Sullivan.pdf
    • http://loaminoo.linkpc.net/1091091096099091/White-Lies-by-Mark-O-39-Sullivan.pdf
    • http://loaminoo.linkpc.net/4094093097093093/Beneath-a-Scarlet-Sky-by-Mark-T-Sullivan.pdf
    • http://loaminoo.linkpc.net/4095093097095093/Outlaw-Robin-Monarch-2-by-Mark-T-Sullivan.pdf
    • http://loaminoo.linkpc.net/9097099099095096/Sullivan-s-Law-Carolyn-Sullivan-1-by-Nancy-Taylor-Rosenberg.pdf
    • http://loaminoo.linkpc.net/9091098094099091/The-Sea-Is-All-Around-by-Elizabeth-Enright.pdf
    • http://loaminoo.linkpc.net/1098096096090097/The-Gathering-by-Anne-Enright.pdf
    • http://loaminoo.linkpc.net/5090094096098093/The-Gathering-by-Anne-Enright.pdf
    • http://loaminoo.linkpc.net/9091098095098096/Blackrock-by-Nick-Enright.pdf
    • http://loaminoo.linkpc.net/3093091099097090/The-Forgotten-Waltz-by-Anne-Enright.pdf
    • http://loaminoo.linkpc.net/1090099098090092/Goof-and-Other-Stories-by-Sean-Enright.pdf
    • http://loaminoo.linkpc.net/1099091097094098/A-Property-Of-The-Clan-by-Nick-Enright.pdf
    • http://loaminoo.linkpc.net/2092096096098090/Thimble-Summer-by-Elizabeth-Enright.pdf
    • http://loaminoo.linkpc.net/4096098090092099/The-Green-Road-by-Anne-Enright.pdf
    • http://loaminoo.linkpc.net/5093091096096093/The-Boys-Book-by-Dominique-Enright.pdf
    • http://loaminoo.linkpc.net/9091098095098091/The-Oxford-Book-of-the-Supernatural-by-D-J-Enright.pdf
    • http://loaminoo.linkpc.net/9091098095099090/Walled-Garden-by-Rosemary-Enright.pdf
    • http://loaminoo.linkpc.net/6099090095095099/The-Pleasure-of-Eliza-Lynch-by-Anne-Enright.pdf
    • http://loaminoo.linkpc.net/1091090096096094/Spiderweb-for-Two-A-Melendy-Maze-by-Elizabeth-Enright.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.