Malicious PDF — malware analysis report

Static analysis result for SHA-256 626ada4584e25052…

MALICIOUS

PDF

14.6 KB Created: 2019-04-30 05:27:06 +01:00 Authoring application: mPDF 5.7
MD5: 68b3603f77ca76f93c212c9cc681a62c SHA-1: c206bfbd034a45845b284cb95a48f128d841ff9f SHA-256: 626ada4584e2505256bd34c6890e1f0642275e11d9db3d09c3de7228c386d996
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files, many of which are hosted on the dynamic DNS domain 'loaminoo.linkpc.net'. This behavior is indicative of a link farm or a phishing lure designed to direct users to potentially malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4090094093096092/Blood-Rush-A-Tale-of-the-Blood-Breed-2-by-Jenika-Snow.pdf
    • http://loaminoo.linkpc.net/7091094096097096/Blood-on-Snow-Der-Auftrag-Blood-on-Snow-1-by-Jo-Nesb-.pdf
    • http://loaminoo.linkpc.net/1091096092097090098/A-Rush-of-Blood-Bob-Skinner-20-by-Quintin-Jardine.pdf
    • http://loaminoo.linkpc.net/1096096092099096/Blood-Rush-Lost-Witch-2-by-Katie-Lee-O-39-Guinn.pdf
    • http://loaminoo.linkpc.net/5097097090094095/V-r-a-havon-Blood-on-Snow-1-by-Jo-Nesb-.pdf
    • http://loaminoo.linkpc.net/8096090090097097/Snow-Blood-and-Envy-by-Jean-Haus.pdf
    • http://loaminoo.linkpc.net/3095098090095093/Cold-Blood-Aidan-Snow-1-by-Alex-Shaw.pdf
    • http://loaminoo.linkpc.net/4095099092090099/The-Vampire-Christopher-Blood-and-Snow-3-by-RaShelle-Workman.pdf
    • http://loaminoo.linkpc.net/2090090091094091/Love-Bleeds-Blood-and-Snow-9-by-RaShelle-Workman.pdf
    • http://loaminoo.linkpc.net/1091090090098090090/Cindy-Witch-Blood-and-Snow-13-by-RaShelle-Workman.pdf
    • http://loaminoo.linkpc.net/7096094094094/Snow-White-Blood-Red-The-Grimm-Diaries-Prequels-1-by-Cameron-Jace.pdf
    • http://loaminoo.linkpc.net/4094093095093095/Zendar-A-Tale-of-Blood-and-Sand-by-K-T-Munson.pdf
    • http://loaminoo.linkpc.net/7092096096093/His-by-Jenika-Snow.pdf
    • http://loaminoo.linkpc.net/4093096092098097/Have-A-Nice-Day-A-Tale-Of-Blood-And-Sweatsocks-by-Mick-Foley.pdf
    • http://loaminoo.linkpc.net/4090099096095090/Blood-Solstice-The-Tale-of-Lunarmorte-3-by-Samantha-Young.pdf
    • http://loaminoo.linkpc.net/3097095097097/Have-a-Nice-Day-A-Tale-of-Blood-and-Sweatsocks-by-Mick-Foley.pdf
    • http://loaminoo.linkpc.net/2090096093094090/Broken-Promise---Blood-Drops-Blood-Stone-1-2-by-Tracy-Cooper-Posey.pdf
    • http://loaminoo.linkpc.net/4094096094094099/Gypsy-Blood-Born-to-Romany-Blood-1-by-Lorrie-Unites-Struiff.pdf
    • http://loaminoo.linkpc.net/2091098099095092/Dark-Banquet-Blood-and-the-Curious-Lives-of-Blood-Feeding-Creatures-by-Bill-Schutt.pdf
    • http://loaminoo.linkpc.net/1099098094094098/Depraved-Blood-A-Young-Bloodsuckers-Vampire-Tale-by-P-J-Dominicis.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.