Malicious PDF — malware analysis report

Static analysis result for SHA-256 aeb029fa3c22ac3b…

MALICIOUS

PDF

14.1 KB Created: 2019-05-07 04:06:12 +01:00 Authoring application: mPDF 5.7
MD5: ad16e586476b1fd708eb83ff6f6a5a47 SHA-1: a8a87703358e4a58f5ea8979485fe5856adb8f98 SHA-256: aeb029fa3c22ac3bc993b56957f47b83188df9dca8569b323bdabfb322047700
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly flagged this PDF as malicious. The dominant host 'loaminoo.linkpc.net' is associated with a link farm, suggesting a deceptive distribution method rather than legitimate content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4090096097094096/Obsidian-Stone-Saga-3-by-Rhiannon-Mackay.pdf
    • http://loaminoo.linkpc.net/2091099090098095/The-Ghost-and-Ms-MacKay-Maggie-MacKay-Magical-Tracker-2-5-by-Kate-Danley.pdf
    • http://loaminoo.linkpc.net/5093093092/Black-Obsidian-Obsidian-1-by-Victoria-Quinn.pdf
    • http://loaminoo.linkpc.net/4096090096099096/The-Honey-Saga-Part-1-Thunder-by-Stone-Higgins.pdf
    • http://loaminoo.linkpc.net/2091094090090092/Dragon-in-My-Yard-The-Stone-Dragon-Saga-Volume-2-by-Elizabeth-S-Tyree.pdf
    • http://loaminoo.linkpc.net/7093099099/Only-Child-by-Rhiannon-Navin.pdf
    • http://loaminoo.linkpc.net/3092096093098091/Death-Sentence-by-Rhiannon-Paille.pdf
    • http://loaminoo.linkpc.net/8090095092096/The-Last-Bastion-of-the-Living-by-Rhiannon-Frater.pdf
    • http://loaminoo.linkpc.net/4093099099099094/Waking-Dream-by-Rhiannon-Lassiter.pdf
    • http://loaminoo.linkpc.net/4094099098090/The-Renfield-Syndrome-Rhiannon-s-Law-2-by-J-A-Saare.pdf
    • http://loaminoo.linkpc.net/3097095091094095/The-Midnight-Spell-by-Rhiannon-Frater.pdf
    • http://loaminoo.linkpc.net/4091099093092090/The-First-Days-As-the-World-Dies-1-by-Rhiannon-Frater.pdf
    • http://loaminoo.linkpc.net/2092095099094097/Blood-Storm-Lharmell-2-by-Rhiannon-Hart.pdf
    • http://loaminoo.linkpc.net/3092096090095090/Hellfire-and-Kittens-Queen-Lucy-1-by-Rhiannon-Lee.pdf
    • http://loaminoo.linkpc.net/9093099093095092/De-f-rste-dage-As-the-World-Dies-1-by-Rhiannon-Frater.pdf
    • http://loaminoo.linkpc.net/4090097092096096/Zombie-Tales-from-Dead-Worlds-by-Rhiannon-Frater.pdf
    • http://loaminoo.linkpc.net/2099099090095091/Death-Comes-Home-In-Darkness-We-Must-Abide-1-by-Rhiannon-Frater.pdf
    • http://loaminoo.linkpc.net/2092095094094095/Fighting-to-Survive-As-The-World-Dies-2-by-Rhiannon-Frater.pdf
    • http://loaminoo.linkpc.net/9096099098096/The-Tyranny-of-Lost-Things-by-Rhiannon-Lucy-Cosslett.pdf
    • http://loaminoo.linkpc.net/8091095090093092/Dire-Warnings-In-Darkness-We-Must-Abide-6-by-Rhiannon-Frater.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.