Malicious PDF — malware analysis report

Static analysis result for SHA-256 a605b169d19ce2fa…

MALICIOUS

PDF

14.9 KB Created: 2019-04-30 04:57:59 +01:00 Authoring application: mPDF 5.7
MD5: 2237decdaa052b3680836d2c5e848e77 SHA-1: 6ee427ef54c996525e24259f237bdf82ad7cb5c7 SHA-256: a605b169d19ce2facdb35ee26dd9034e40e87d161ebc2ffde0a267516ebf60db
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier as malicious. It contains a large number of embedded links, identified as a PDF SEO link farm, pointing to various book titles hosted on loaminoo.linkpc.net. While the specific intent beyond link farming is unclear due to the lack of executable scripts or user-facing text, this technique is often used to distribute malware or engage in phishing by luring users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1096097093097096/Servant-of-the-Underworld-Obsidian-and-Blood-1-by-Aliette-de-Bodard.pdf
    • http://loaminoo.linkpc.net/2093090094093095/Servant-of-the-Underworld-Obsidian-and-Blood-1-by-Aliette-de-Bodard.pdf
    • http://loaminoo.linkpc.net/2093098096095098/Harbinger-of-the-Storm-Obsidian-and-Blood-2-by-Aliette-de-Bodard.pdf
    • http://loaminoo.linkpc.net/3094093094091098/The-Tea-Master-and-the-Detective-by-Aliette-de-Bodard.pdf
    • http://loaminoo.linkpc.net/2094097098092/On-a-Red-Station-Drifting-by-Aliette-de-Bodard.pdf
    • http://loaminoo.linkpc.net/7097096099099093/The-Citadel-of-Weeping-Pearls-by-Aliette-de-Bodard.pdf
    • http://loaminoo.linkpc.net/3098096098095099/The-House-of-Binding-Thorns-Dominion-of-the-Fallen-2-by-Aliette-de-Bodard.pdf
    • http://loaminoo.linkpc.net/3095093093097091/The-House-of-Shattered-Wings-Dominion-of-the-Fallen-1-by-Aliette-de-Bodard.pdf
    • http://loaminoo.linkpc.net/9098095099098097/The-Society-of-Blood-Obsidian-Heart-2-by-Mark-Morris.pdf
    • http://loaminoo.linkpc.net/7099098091098093/A-Touch-of-Blood-Operation-Underworld-Connor-amp-Sami-1-by-Carly-Fall.pdf
    • http://loaminoo.linkpc.net/5093093092/Black-Obsidian-Obsidian-1-by-Victoria-Quinn.pdf
    • http://loaminoo.linkpc.net/2096097092099096/Delete-This-At-Your-Peril-The-Bob-Servant-Emails-by-Bob-Servant.pdf
    • http://loaminoo.linkpc.net/7099091097094092/Servant-The-Acceptance-Servant-2-by-L-L-Foster.pdf
    • http://loaminoo.linkpc.net/3094097096098097/His-Master-s-Servant-Bundle-1-His-Master-s-Servant-1-3-by-Sage-Hampton.pdf
    • http://loaminoo.linkpc.net/4090095096098/Welcome-to-the-Underworld-A-Welcome-to-the-Underworld-Novel-1-by-Con-Template.pdf
    • http://loaminoo.linkpc.net/7097097090095099/Green-hell-Massacre-of-the-Brazilian-Indians-by-Lucien-Bodard.pdf
    • http://loaminoo.linkpc.net/7097097090095096/Digital-Research-In-The-Study-Of-Classical-Antiquity-by-Gabriel-Bodard.pdf
    • http://loaminoo.linkpc.net/5090090090097096/The-Obsidian-Man-by-Jon-Wilson.pdf
    • http://loaminoo.linkpc.net/1093093095090099/Obsidian-Eyes-by-A-W-Exley.pdf
    • http://loaminoo.linkpc.net/5090090097090093/Obsidian-Lux-1-by-Jennifer-L-Armentrout.pdf
    • http://loaminoo.linkpc.net/5093093092/Black-Obsidian-Obsidian-1-by-Victoria-Quinn

Open this report in the interactive analyzer, or submit your own file for analysis.