Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5a50f5d8ca2c744…

MALICIOUS

PDF

13.8 KB Created: 2019-04-29 23:04:48 +01:00 Authoring application: mPDF 5.7
MD5: ee7d871ea39680ff7090fec21769b8cd SHA-1: e47871d0ced249bc6fa4fa2b008c6f8243d4321e SHA-256: c5a50f5d8ca2c744bdd97dc8ba2c203151511092dbf87a82de07aee3ad9ab420
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a PDF SEO link farm containing numerous embedded links to external PDF files hosted on loaminoo.linkpc.net. While the document body is heavily obfuscated, the presence of these links suggests a distribution or redirection mechanism. The primary attack pattern involves leveraging these links, potentially to lead users to malicious sites or to distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4093092090095097/Lightning-87th-Precinct-37-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/3095096094095097/The-Con-Man-87th-Precinct-4-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/2096096091092093/Poison-87th-Precinct-39-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/8090097093094/Lullaby-87th-Precinct-41-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/4099096092097092/The-Heckler-87th-Precinct-12-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/8094090093094098/Jigsaw-87th-Precinct-24-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/1094093098092095/Hark-87th-Precinct-54-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/3094094093097093/The-Big-Bad-City-87th-Precinct-49-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/8092095097094/Long-Time-No-See-87th-Precinct-32-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/5090094099092094/Killer-s-Payoff-87th-Precinct-6-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/3096092096092096/Hail-Hail-the-Gang-s-All-Here-87th-Precinct-25-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/3095094091094094/Lady-Lady-I-Did-It-87th-Precinct-14-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/2091091098093091/Nine-Month-Protector-The-Precinct-Vice-Squad-2-The-Precinct-6-by-Julie-Miller.pdf
    • http://loaminoo.linkpc.net/2094094094099098/Protecting-the-Pregnant-Witness-The-Precinct-SWAT-3-The-Precinct-15-by-Julie-Miller.pdf
    • http://loaminoo.linkpc.net/2090092095091099/Man-with-the-Muscle-The-Precinct-SWAT-1-The-Precinct-13-by-Julie-Miller.pdf
    • http://loaminoo.linkpc.net/5090094093095097/Red-Lightning-Thunder-and-Lightning-2-by-John-Varley.pdf
    • http://loaminoo.linkpc.net/4094094099091097/Transgressions-Novellas-2-3-amp-5-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/7099096091092093/A-Study-in-Scarlet-by-Ed-McBain.pdf
    • http://loaminoo.linkpc.net/3090092094099094/McCade-s-Way-by-Mara-McBain.pdf
    • http://loaminoo.linkpc.net/2093090091098097/McCade-s-Way-by-Mara-McBain.pdf
    • http://loaminoo.linkpc.net/2091091098093091/Nin

Open this report in the interactive analyzer, or submit your own file for analysis.