Malicious PDF — malware analysis report

Static analysis result for SHA-256 5309028593300db3…

MALICIOUS

PDF

16.6 KB Created: 2019-05-02 06:23:30 +01:00 Authoring application: mPDF 5.7
MD5: 1dfdbb0ecb18d3fa610a700f5cf54862 SHA-1: 97fe34d177b82a6b8bea2f644b7e3ef1505d9248 SHA-256: 5309028593300db379aa08bc10e878a8afb37269e66666a00cb592207eafc388
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, primarily hosted on 'loaminoo.linkpc.net'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content disguised as legitimate documents. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9913

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3094093095093095/Mad-Ship-Liveship-Traders-2-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/3095090093097097/Ship-of-Magic-Liveship-Traders-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/5094090090096/Novels-By-Robin-Hobb-including-Assassin-s-Apprentice-Royal-Assassin-Assassin-s-Quest-Fool-s-Errand-novel-The-Golden-Fool-Shaman-s-Crossing-Fool-s-Fate-Ship-Of-Magic-Forest-Mage-Renegade-s-Magic-Dragon-Keeper-hobb-Novel-Ship-Of-Destiny-by-Hephaestus-Books.pdf
    • http://loaminoo.linkpc.net/2092091090098096/The-Inheritance-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/4093099098093096/Royal-Assassin-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/4092097094098091/Shaman-s-Crossing-Soldier-Son-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/3095098096099094/Fool-s-Fate-Tawny-Man-3-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/3093099095096/Fool-s-Errand-Tawny-Man-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/3093092097095/Royal-Assassin-Farseer-Trilogy-2-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/7093097094093/O-Punhal-do-Soberano-A-Saga-do-Assassino-2-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/3099091096094/Assassin-s-Apprentice-Farseer-Trilogy-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/2097094099096094/Assassin-s-Apprentice-Farseer-Trilogy-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/7091096099095095/Assassin-s-Quest-Farseer-Trilogy-3-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/6096093094093/Royal-Assassin-Farseer-Trilogy-2-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/3095090095090090/Assassin-s-Quest-Farseer-Trilogy-3-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/1090097096097/The-Dragon-Keeper-Rain-Wild-Chronicles-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/2097094094097096/Dragon-Keeper-Rain-Wilds-Chronicles-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/7090095092095091/Dragon-Keeper-Rain-Wild-Chronicles-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/4097099092096091/Dragon-Haven-Rain-Wild-Chronicles-2-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/3097098099098096/Dragon-Keeper-Rain-Wild-Chronicles-1-by-Robin-Hobb.pdf
    • http://loaminoo.linkpc.net/3093092097095/R

Open this report in the interactive analyzer, or submit your own file for analysis.