Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5ab7912ffb84521…

MALICIOUS

PDF

16.0 KB Created: 2019-04-30 05:38:44 +01:00 Authoring application: mPDF 5.7
MD5: e08a56d38f2a4402ca7c33318c7ab7d1 SHA-1: 2e0de7290fbeb821227b83880e65f614598ca3fe SHA-256: c5ab7912ffb845212ecc1377a53e517c8b49a77dc9fba4a87c809fae7288bd8f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, forming a link farm hosted on 'loaminoo.linkpc.net'. This heuristic strongly suggests a SEO spam or phishing campaign designed to drive traffic to these book-themed links. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9892

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1097095092093091/Morbid-Tales-by-Quentin-S-Crisp.pdf
    • http://loaminoo.linkpc.net/1097095091090096/All-God-s-Angels-Beware-by-Quentin-S-Crisp.pdf
    • http://loaminoo.linkpc.net/1091098094092098090/The-Silhouette-A-Morbid-Tale-The-Morbid-Tales-Book-4-by-Zachery-Miller.pdf
    • http://loaminoo.linkpc.net/1091098094091099097/The-Nightcomer-A-Morbid-Tale-The-Morbid-Tales-Book-3-by-Zachery-Miller.pdf
    • http://loaminoo.linkpc.net/1091098094094094097/The-Unbeliever-A-Morbid-Tale-The-Morbid-Tales-Book-5-by-Zachery-Miller.pdf
    • http://loaminoo.linkpc.net/1091098094091098098/The-Morbid-and-Sultry-Tales-of-Genevieve-Clare-by-J-B-Hartnett.pdf
    • http://loaminoo.linkpc.net/3090097095090092/Broken-Mirror-and-Other-Morbid-Tales-by-Carmilla-Voiez.pdf
    • http://loaminoo.linkpc.net/7090096094098099/Flamingo-and-Ogre-Uncle-Jeever-s-Morbid-Tales-1-by-N-Nada.pdf
    • http://loaminoo.linkpc.net/4090093092092093/Pulp-Fiction-A-Quentin-Tarantino-Screenplay-by-Quentin-Tarantino.pdf
    • http://loaminoo.linkpc.net/1092094094095094/White-Star-A-Dog-On-The-Titanic-by-Marty-Crisp.pdf
    • http://loaminoo.linkpc.net/9099092095091093/My-Smoky-Bacon-Crisp-Obsession-by-J-A-Buckle.pdf
    • http://loaminoo.linkpc.net/3091092090090095/Edgar-and-the-Lying-Potion-by-Jeremy-C-Crisp.pdf
    • http://loaminoo.linkpc.net/4099091097095094/Burned-to-a-Crisp-Cookies-amp-Chance-Mystery-3-by-Catherine-Bruns.pdf
    • http://loaminoo.linkpc.net/3094090090095093/Star-Wars-Tales-Omnibus-Tales-from-the-Mos-Eisley-Cantina-Tales-of-the-Bounty-Hunters-and-Tales-from-Jabba-s-Palace-by-Kevin-J-Anderson.pdf
    • http://loaminoo.linkpc.net/3091095099091097/No-Buddy-Left-Behind-Bringing-U-S-Troops-Dogs-and-Cats-Safely-Home-from-the-Combat-Zone-by-Terri-Crisp.pdf
    • http://loaminoo.linkpc.net/1091098094093095095/Morbid-by-Kyo-VR.pdf
    • http://loaminoo.linkpc.net/4097099094098095/Patrick-by-Quentin-Blake.pdf
    • http://loaminoo.linkpc.net/1098095091098093/Angelo-by-Quentin-Blake.pdf
    • http://loaminoo.linkpc.net/4099098095097098/Clown-by-Quentin-Blake.pdf
    • http://loaminoo.linkpc.net/1091092094094095/Cockatoos-by-Quentin-Blake.pdf
    • http://loaminoo.linkpc.net/4099091097095094/Burned-to-a-Crisp-Cookies-amp-Cha

Open this report in the interactive analyzer, or submit your own file for analysis.