Malicious PDF — malware analysis report

Static analysis result for SHA-256 90b8151daf629b14…

MALICIOUS

PDF

16.5 KB Created: 2019-04-30 02:28:21 +01:00 Authoring application: mPDF 5.7
MD5: dea2c59b20f0ca86ca32bba243f53cf9 SHA-1: e9b057caae7d434b8c2bee42b3b100920cc81987 SHA-256: 90b8151daf629b140329652b703d0c084cbee1ab5b8cb9c0e2ef21151fd845ac
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDF documents hosted on the domain 'loaminoo.linkpc.net'. This behavior is indicative of a link farm or SEO poisoning attack, designed to drive traffic to potentially malicious or unwanted content. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2092091095098094/Subterranean-Magazine-Summer-2011-by-William-Schafer.pdf
    • http://loaminoo.linkpc.net/9094095094091096/Subterranean-Magazine-Summer-2012-by-William-Schafer.pdf
    • http://loaminoo.linkpc.net/9094095093095092/Subterranean-Tales-of-Dark-Fantasy-2-by-William-Schafer.pdf
    • http://loaminoo.linkpc.net/5091093098090091/Subterranean-Radio-Songs-by-Joel-Deane.pdf
    • http://loaminoo.linkpc.net/5091097098099092/Caves-Exploring-New-Zealand-s-Subterranean-Wilderness-by-Marcus-Thomas.pdf
    • http://loaminoo.linkpc.net/9092096092099092/Mosaic-Evolution-of-Subterranean-Mammals-Regression-Progression-and-Global-Convergence-by-Eviatar-Nevo.pdf
    • http://loaminoo.linkpc.net/1090096094095093097/Sternenstaub-by-Harald-Schafer.pdf
    • http://loaminoo.linkpc.net/1090096096091096096/Zerbrochene-Illusionen-by-H-W-Sch-fer.pdf
    • http://loaminoo.linkpc.net/9094095094095097/An-Almighty-Conspiracy-by-Fred-Sch-fer.pdf
    • http://loaminoo.linkpc.net/1091098096097097096/BUDDHA-SPR-CHE-by-Kl-ber-Sch-fer.pdf
    • http://loaminoo.linkpc.net/8099091093091092/Rituale-und-Ritualisierungenglish-by-Alfred-Sch-fer.pdf
    • http://loaminoo.linkpc.net/9094095093090092/The-Ghost-of-Schafer-Meadows-by-Beth-Hodder.pdf
    • http://loaminoo.linkpc.net/8096099094093098/Die-Lebenssituation-Alleinstehender-Frauen-by-Ingo-Schafer.pdf
    • http://loaminoo.linkpc.net/1090096095095095092/Abfallentsorgung-in-Gewerblichen-Kuchen-by-Ellen-Schafer.pdf
    • http://loaminoo.linkpc.net/2093098097091094/London-Under-London-A-Subterranean-Guide-by-Richard-Trench.pdf
    • http://loaminoo.linkpc.net/9094095093095098/My-Life-with-Michael-A-Novel-of-Sex-Beer-and-Middle-Age-by-Lori-Schafer.pdf
    • http://loaminoo.linkpc.net/9097093094097/The-Solution-Within-Yourself-Closing-the-gap-between-who-you-are-today-and-who-you-want-to-be-tomorrow-by-Fred-Sch-fer.pdf
    • http://loaminoo.linkpc.net/4098098090098092/The-Whitefire-Crossing-Shattered-Sigil-1-by-Courtney-Schafer.pdf
    • http://loaminoo.linkpc.net/5096097095095097/Distracting-Ghosts-Tess-Schafer-Medium-7-by-Deborah-J-Hughes.pdf
    • http://loaminoo.linkpc.net/1090091093094096092/Das-Bimmel-ist-ein-hochloder-Diffel-Aus-den-Carlos-Kolumnen-by-Carlo-Sch-fer.pdf
    • http://loaminoo.linkpc.net/1091098096097097096/BUDDHA-SPR-CHE-by-Kl-ber-Sc

Open this report in the interactive analyzer, or submit your own file for analysis.