Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c6aef90cdd72dff…

MALICIOUS

PDF

15.0 KB Created: 2019-05-02 17:29:27 +01:00 Authoring application: mPDF 5.7
MD5: 04ab4769745dfc1bdec3a8c601c25952 SHA-1: 41418653b96655db8cf91b9767a7970da0ccfb65 SHA-256: 9c6aef90cdd72dffc9da79795d3fc7fd59b89b0d8f9fcee3bbe074cf56f32941
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains a large number of embedded links to external PDF files, all hosted on the suspicious domain 'loaminoo.linkpc.net'. This behavior is indicative of a link farm or a content-spreading operation, likely intended to drive traffic or distribute further malicious content. No scripts were extracted, and the document body was heavily obfuscated, but the heuristic 'PDF_SEO_LINK_FARM' strongly suggests this malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090096097099097099/Zum-Dreier-verf-hrt-Hei-e-Dreier-Erotik-by-Bernadette-Binkowski.pdf
    • http://loaminoo.linkpc.net/8098096097095097/Flotter-Dreier-in-der-Karibik---Erotik-f-r-Frauen-by-Maik-Lindbacher.pdf
    • http://loaminoo.linkpc.net/9095091090092091/Verkauft-an-den-Lord-Erotik-im-Barockzeitalter-by-Bernadette-Binkowski.pdf
    • http://loaminoo.linkpc.net/8098096097095090/Flotter-Dreier-Sex-Bilderbuch-Xxx-Erotik-Babes-Nackt-Bilder-by-Elfriede-Lehner.pdf
    • http://loaminoo.linkpc.net/1090096097099099098/Forces-And-Motion-by-David-Dreier.pdf
    • http://loaminoo.linkpc.net/1090096097099097090/Strategy-Planning-amp-Litigating-to-Win-by-A-S-Dreier.pdf
    • http://loaminoo.linkpc.net/1090096098090090092/Be-a-Demolition-Engineer-by-David-Dreier.pdf
    • http://loaminoo.linkpc.net/1090096098090094091/Drei-Dreier-Sexgeschichten-by-Eva-Neuveard.pdf
    • http://loaminoo.linkpc.net/1090096098090090091/Be-a-Storm-Chaser-by-David-Dreier.pdf
    • http://loaminoo.linkpc.net/1090096097099099094/Geplanter-Dreier-by-Peer-Moulin.pdf
    • http://loaminoo.linkpc.net/1090096098090094096/Geiler-Dreier-mit-Laura-by-Lisa-Lust.pdf
    • http://loaminoo.linkpc.net/1090091099094090097/Hei-er-Dreier-im-Doppelzimmer-by-Lola-Hammerfeld.pdf
    • http://loaminoo.linkpc.net/1090096097099097092/Contemporary-Debates-In-Moral-Theory-by-James-Dreier.pdf
    • http://loaminoo.linkpc.net/8098096096096092/Flotter-Dreier-mit-meinen-Stiefschwestern-by-Mary-Bischoff.pdf
    • http://loaminoo.linkpc.net/1090096097099097094/Jim-Morrison-The-Scream-Of-The-Butterfly-Sonderausgabe-by-Daniel-Dreier.pdf
    • http://loaminoo.linkpc.net/1091094099099098097/W-hrend-die-Braut-schlief-Erstes-Mal-Dreier-by-Lina-Heinen.pdf
    • http://loaminoo.linkpc.net/1090093096094091097/Anale-Lust-Scharfe-Erotikstory-by-Bernadette-Binkowski.pdf
    • http://loaminoo.linkpc.net/1090093096094092091/Weihnachtsgeschenk-anal-Scharfe-Erotikstory-by-Bernadette-Binkowski.pdf
    • http://loaminoo.linkpc.net/8098096097095091/Eine-Nacht-zu-dritt---Flotter-Dreier-mit-unserer-Freundin-by-Annie-Aurion.pdf
    • http://loaminoo.linkpc.net/1090091098097098098/Im-Swingerclub-vom-Chef-erwischt-Geile-Erotikgeschichte-by-Bernadette-Binkowski.pdf
    • http://loaminoo.linkpc.net/1090096097099097092/Contemporary-De

Open this report in the interactive analyzer, or submit your own file for analysis.