Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e6883a61352feda…

MALICIOUS

PDF

15.1 KB Created: 2019-05-02 01:44:32 +01:00 Authoring application: mPDF 5.7
MD5: 2ddcd581c7620369912cbd7efbd38dff SHA-1: 941c0bf912226548894584853e59372c829416f8 SHA-256: 9e6883a61352feda47b84d2c95f74a80ba825f53220b36c0b20b8948b6d510ce
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded links, identified as a 'PDF_SEO_LINK_FARM' heuristic. These links predominantly point to the 'loaminoo.linkpc.net' domain and appear to be structured to mimic book titles, suggesting a potential lure or SEO abuse tactic. No scripts were extracted, and the document body was unreadable, limiting further analysis of the specific user-facing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2094099093097094/Landline-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/5092094090091/Fangirl-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/7096095092098093/Runaways-1-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/7097096097093/Carry-On-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/2091097099096093/Attachments-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/2095099094/Carry-On-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/3095090096099095/Eleanor-amp-Park-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/6090095098099/Eleanor-amp-Park-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/7096091099092/Eleanor-amp-Park-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/5099090094094096/Eleanor-amp-Park-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/5095098090/Carry-On-Simon-Snow-1-by-Rainbow-Rowell.pdf
    • http://loaminoo.linkpc.net/1099094097098099/Kindred-Spirits-by-Sarah-Strohmeyer.pdf
    • http://loaminoo.linkpc.net/4096099099098098/Kindred-Spirits-by-Jordan-Castillo-Price.pdf
    • http://loaminoo.linkpc.net/3096094097093097/Kindred-Spirits-How-the-Remarkable-Bond-Between-Humans-and-Animals-Can-Change-the-Way-we-Live-by-Allen-M-Schoen.pdf
    • http://loaminoo.linkpc.net/2099097090095094/Kindred-of-the-Fallen-Kindred-Chronicles-1-by-Iris-i.pdf
    • http://loaminoo.linkpc.net/1098091098092095/Kindred-Kindred-1-by-Nicola-Claire.pdf
    • http://loaminoo.linkpc.net/1092098099096099/Kindred-Kindred-1-by-Nicola-Claire.pdf
    • http://loaminoo.linkpc.net/2092098098094091/Spirits-of-the-Plains-Book-one-of-the-Spirits-Saga-by-Daniel-Glen-Matuzas.pdf
    • http://loaminoo.linkpc.net/1090098091093093098/Die-Regenbogenfahne---Entstehung-und-Bedeutung-und-wissenswertes-ber-den-CSD-LBGTIQ-Symbole-und-dem-Two-Spirits-by-Sundance---Two-Spirits.pdf
    • http://loaminoo.linkpc.net/9091090092093095/Dangerous-Spirits-Spirits-2-by-Jordan-L-Hawk.pdf
    • http://loaminoo.linkpc.net/3096094097093097/Kindred-Spi

Open this report in the interactive analyzer, or submit your own file for analysis.