Malicious PDF — malware analysis report

Static analysis result for SHA-256 7003181054a7b7d3…

MALICIOUS

PDF

16.2 KB Created: 2019-04-30 02:41:05 +01:00 Authoring application: mPDF 5.7
MD5: ad78ebe3a9de4d116bbab70006a24e9e SHA-1: e2b7ef3fd6e5459acc904865c5f9cbd548e2596a SHA-256: 7003181054a7b7d3ddbc6208b1ecb18bba52cba6732afb14fc16ab6d640bb5ab
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified as a link farm, pointing to various book titles hosted on the `loaminoo.linkpc.net` domain. While the URLs themselves are marked as benign, the sheer volume and the heuristic firing of 'PDF_SEO_LINK_FARM' suggest a malicious intent to direct users to potentially harmful content. The ML classifier also flagged this PDF as malicious. The embedded links likely serve as a lure to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2096093096098098/Kidnapping-His-Bride-The-Renaldis-2-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/3097092096092099/Temporary-Arrangement-The-Renaldis-0-5-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/2092099092098096/Tempted-by-Her-Boss-The-Renaldis-1-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/4095090097093094/Indulgent-Pleasures-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/4097099093093098/Under-My-Umbrella-Fated-1-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/1091091097097099094/Neon-Chaos-End-of-Days-2-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/7095097099093/A-Scandalous-Affair-The-Merry-Widows-3-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/3090090099093097/Lessons-in-Indiscretion-The-Merry-Widows-1-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/3097094092099090/Her-Christmas-Pleasure-The-Merry-Widows-2-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/3094097099095093/Worth-The-Challenge-Worth-It-3-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/7097091099094093/Fortune-s-Deception-Fortune-1-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/2092090090094095/Game-for-Trouble-Game-for-It-2-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/2094096098098095/Worth-the-Risk-Worth-It-2-by-Karen-Erickson.pdf
    • http://loaminoo.linkpc.net/4096099095093097/A-Belated-Bride-Rogues-2-by-Karen-Hawkins.pdf
    • http://loaminoo.linkpc.net/2093093098098093/Bride-by-Arrangement-Cowboy-Creek-3-by-Karen-Kirst.pdf
    • http://loaminoo.linkpc.net/4098099097099/The-Brides-Trilogy-A-3-In-1-Edition-Including-The-Sherbrooke-Bride-The-Hellion-Bride-And-The-Heiress-Bride-by-Catherine-Coulter.pdf
    • http://loaminoo.linkpc.net/6095090097097095/The-Right-Bride-Bride-of-Desire-The-English-Aristocrat-s-Bride-Vacancy-Wife-of-Convenience-by-Sara-Craven.pdf
    • http://loaminoo.linkpc.net/4099098092096090/Openers-II-The-Lyrics-of-Roky-Erickson-by-Roky-Erickson.pdf
    • http://loaminoo.linkpc.net/4097093097090095/The-Thursday-Kidnapping-by-Antonia-Forest.pdf
    • http://loaminoo.linkpc.net/1095090095095/The-Kidnapping-of-Edgardo-Mortara-by-David-I-Kertzer.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.