Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5998822e9fd31eb…

MALICIOUS

PDF

17.1 KB Created: 2019-04-30 04:32:30 +01:00 Authoring application: mPDF 5.7
MD5: 997644861b13713f20add376380f24f9 SHA-1: c2d9e8986eb4380b31d351d1cf8ee1f80348eef3 SHA-256: c5998822e9fd31eb6c5220d9f65fe404bc483ff1ab466f8bd861efc57f4c67a9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDFs hosted on the domain 'loaminoo.linkpc.net'. This behavior is indicative of a link farm or a lure to a malicious site, as flagged by the PDF_SEO_LINK_FARM heuristic. While the individual linked PDFs were classified as benign, the sheer volume and the suspicious domain suggest a malicious intent to direct users to potentially harmful content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7099092096092097/Mikhail-Bulgakov-Life-and-Interpretations-by-A-C-Wright.pdf
    • http://loaminoo.linkpc.net/7099092096093091/Mikhail-Bulgakov-Mikhail-Bulgakov-Bibliography-Bulgakov-Museum-in-Moscow-Mikhail-Bulgakov-Museum-by-Books-LLC.pdf
    • http://loaminoo.linkpc.net/7099092097095099/Moli-re-or-The-Cabal-of-Hypocrites-and-Don-Quixote-Two-Plays-by-Mikhail-Bulgakov-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/7099092097095096/Is-Comrade-Bulgakov-Dead-Mikhail-Bulgakov-at-the-Moscow-Art-Theatre-by-A-M-Smelianskii.pdf
    • http://loaminoo.linkpc.net/7099092095092094/Beg-Flight-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/3090095095093094/The-Heart-of-a-Dog-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/8095099098097097/The-Master-and-Margarita-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/6090091092098096/The-Master-and-Margarita-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/2099099092096091/The-Master-and-Margarita-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/4093090091092094/The-Master-and-Margarita-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/3093095092092096/The-Master-and-Margarita-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/2095093097095092/The-Fatal-Eggs-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/3091096096094092/--by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/3097091097094092/The-Fatal-Eggs-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/3094093099090092/The-Fatal-Eggs-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/1093098094091098/A-Young-Doctor-s-Notebook-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/7099092094099096/Notes-on-the-Cuff-and-Other-Stories-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/9097091099095093/S-ddeutsche-Zeitung-eBibliothek-Die-Kriegsromane-Die-wei-e-Garde-Die-Stalinorgel-Sara-und-Serafina-1948-Roman-Die-Abenteuer-des-braven-Soldaten-Schwejk-by-Mikhail-Bulgakov.pdf
    • http://loaminoo.linkpc.net/2093092094091090/The-Ages-of-Man-Medieval-Interpretations-of-the-Life-Cycle-by-Elizabeth-Sears.pdf
    • http://loaminoo.linkpc.net/3094094091098097/Mikhail-Kuzmin-Selected-Writings-by-Mikhail-Kuzmin.pdf
    • http://loaminoo.linkpc.net/6090091092098096/Th

Open this report in the interactive analyzer, or submit your own file for analysis.