Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb9303df879ebda0…

MALICIOUS

PDF

12.7 KB Created: 2019-04-30 03:54:55 +01:00 Authoring application: mPDF 5.7
MD5: 00b88dd063fa3603aa26f152e4c891e5 SHA-1: d60be29fd02d792dc327bb966203c670c2a89a63 SHA-256: cb9303df879ebda0d337a836bb3246a9b2b2afc2c1047d6b65bbc912eb3fdad6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a large number of embedded links, characteristic of a link farm or SEO poisoning attack. The primary heuristic indicates a "PDF_SEO_LINK_FARM" with a dominant host of "loaminoo.linkpc.net". While the document body is heavily corrupted, the presence of numerous links suggests an attempt to lure users to external, potentially malicious, content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8905

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090092099090097090/Casablanca-Forget-Me-Not-by-Dahlian.pdf
    • http://loaminoo.linkpc.net/1090092099090096099/Beyond-Casablanca-by-Jennifer-C-Garlen.pdf
    • http://loaminoo.linkpc.net/1090092099090097093/Like-Casablanca-by-Sylvia-Massara.pdf
    • http://loaminoo.linkpc.net/1090092099090096098/Casablanca-by-Michael-Moorcock.pdf
    • http://loaminoo.linkpc.net/6092091098098099/Casablanca-Blues-by-Tahir-Shah.pdf
    • http://loaminoo.linkpc.net/3099094096099093/The-Caliph-s-House-A-Year-in-Casablanca-by-Tahir-Shah.pdf
    • http://loaminoo.linkpc.net/4094097092090098/Casablanca-Companion-The-Movie-Classic-and-Its-Place-in-History-by-Richard-E-Osborne.pdf
    • http://loaminoo.linkpc.net/8095098095/Forget-You-Ethan-Forget-You-Ethan-1-by-Whitney-G-.pdf
    • http://loaminoo.linkpc.net/1098090093092092/Forget-Me-by-K-A-Harrington.pdf
    • http://loaminoo.linkpc.net/6091096090093095/A-Hard-Man-to-Forget-by-Dan-Ames.pdf
    • http://loaminoo.linkpc.net/6091092091090/Don-t-Forget-Steven-by-P-D-Workman.pdf
    • http://loaminoo.linkpc.net/3096095091092097/Forget-Me-Not-by-Elizabeth-Lowell.pdf
    • http://loaminoo.linkpc.net/2091097093096091/Don-t-Forget-Me-Konigsburg-6-by-Meg-Benjamin.pdf
    • http://loaminoo.linkpc.net/1095090090090099/Forget-Me-Not-by-Anne-Cassidy.pdf
    • http://loaminoo.linkpc.net/4093093095098092/Don-t-Let-me-Forget-You-by-Cara-Crescent.pdf
    • http://loaminoo.linkpc.net/5090090097094096/Forget-Me-Never-by-Gina-Blaxill.pdf
    • http://loaminoo.linkpc.net/4092096097090093/Forget-You-Know-Me-by-Jessica-Strawser.pdf
    • http://loaminoo.linkpc.net/5092096096/Forget-Me-Not-by-Ellie-Terry.pdf
    • http://loaminoo.linkpc.net/2090099095093096/Forget-Me-Not-Flowering-1-1-by-Sarah-Daltry.pdf
    • http://loaminoo.linkpc.net/2093093098091098/Remember-to-Forget-by-Ashley-Royer.pdf
    • http://loaminoo.linkpc.net/2091097093096091/Don-t-Forget-Me-Konigsburg-

Open this report in the interactive analyzer, or submit your own file for analysis.