Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc9f20b3bb8c1717…

MALICIOUS

PDF

14.5 KB Created: 2019-05-01 12:49:25 +01:00 Authoring application: mPDF 5.7
MD5: d18f7edd239a876cc3cb00ceaf3bc0a7 SHA-1: f4ed86b43b13dee9d148ecb752806ddce476d818 SHA-256: bc9f20b3bb8c17171f16237b3bf0c7a7b95b6672c0a7cc094d20e4e37e79a11f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links disguised as book titles, which is indicative of a link farm or a lure for users to download further content. The ML classifier also flagged this PDF as malicious with a high probability. The primary attack pattern involves directing users to external URLs hosted on 'loaminoo.linkpc.net' under the guise of providing book downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3091090098093096/The-Guns-of-August-by-Barbara-W-Tuchman.pdf
    • http://loaminoo.linkpc.net/1099090099099094/The-Guns-of-August-The-Proud-Tower-by-Barbara-W-Tuchman.pdf
    • http://loaminoo.linkpc.net/4094096096093092/The-First-Salute-by-Barbara-W-Tuchman.pdf
    • http://loaminoo.linkpc.net/3097094092099/The-March-of-Folly-From-Troy-to-Vietnam-by-Barbara-W-Tuchman.pdf
    • http://loaminoo.linkpc.net/2097094097091098/A-Distant-Mirror-The-Calamitous-14th-Century-by-Barbara-W-Tuchman.pdf
    • http://loaminoo.linkpc.net/1093099091099096/The-Proud-Tower-A-Portrait-of-the-World-Before-the-War-1890-1914-by-Barbara-W-Tuchman.pdf
    • http://loaminoo.linkpc.net/2096097099098096/August-Gale-A-Father-and-Daughter-s-Journey-into-the-Storm-by-Barbara-Walsh.pdf
    • http://loaminoo.linkpc.net/1098096092094097/Guns-n-Boys-Homicidal-Instinct-Guns-n-Boys-3-by-K-A-Merikan.pdf
    • http://loaminoo.linkpc.net/4090093090090094/Guns-n-Boys-Homicidal-Instinct-Guns-n-Boys-3-by-K-A-Merikan.pdf
    • http://loaminoo.linkpc.net/1096090097091096/Guns-n-Boys-Paris-Guns-n-Boys-1-3-by-K-A-Merikan.pdf
    • http://loaminoo.linkpc.net/1090098098093097092/Hearth-and-Home-Images-of-Women-in-the-Mass-Media-by-Gaye-Tuchman.pdf
    • http://loaminoo.linkpc.net/1090098098093091093/Edging-Women-Out-Victorian-Novelists-Publishers-And-Social-Change-by-Gaye-Tuchman.pdf
    • http://loaminoo.linkpc.net/5090098096091094/August-Strindberg-Selected-Essays-by-August-Strindberg.pdf
    • http://loaminoo.linkpc.net/1099091097091090/Guns-and-Goannas-by-J-S-Browne.pdf
    • http://loaminoo.linkpc.net/1098097096094091/Guns-Up-by-Johnnie-M-Clark.pdf
    • http://loaminoo.linkpc.net/3099099096097097/Guns-of-Vengeance-by-Jackson-Cole.pdf
    • http://loaminoo.linkpc.net/1090096096096099094/GUNS-AND-UNIVERSE-zero-one-by-Rasen-Kagurazaka.pdf
    • http://loaminoo.linkpc.net/1090094097092098096/MG-34-and-MG-42-Machine-Guns-by-Chris-McNab.pdf
    • http://loaminoo.linkpc.net/3098094094094095/JG-26-Top-Guns-of-the-Luftwaffe-by-Donald-L-Caldwell.pdf
    • http://loaminoo.linkpc.net/7093095091090091/Guns-of-Palambang-by-Peter-McCurtin.pdf
    • http://loaminoo.linkpc.net/1090098098

Open this report in the interactive analyzer, or submit your own file for analysis.