Malicious PDF — malware analysis report

Static analysis result for SHA-256 d607c0ac0264981f…

MALICIOUS

PDF

14.6 KB Created: 2019-04-30 02:34:39 +01:00 Authoring application: mPDF 5.7
MD5: 32e012c71fda5c3c6de1a915b1e438fc SHA-1: 4193c9c71e40b09c9116baffcbd6ab2cf03c424f SHA-256: d607c0ac0264981f6fcd254c51a695f702b9a6e3075e610968b875d420f26d50
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded URLs, forming a link farm. The heuristic PDF_SEO_LINK_FARM indicates this is a tactic to drive traffic to the dominant host, loaminoo.linkpc.net. While the URLs themselves are marked as benign, the sheer volume and structure suggest a malicious intent to redirect users. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2096090090097092/The-Diviners-The-Diviners-1-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/7091096095099/The-Diviners-The-Diviners-1-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/3090097093099/The-Diviners-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/8096093094091098/Libba-Bray-Books-Checklist-Reading-Order-of-Gemma-Doyle-Series-The-Diviners-Series-and-List-of-All-Libba-Bray-Books-by-Kevin-Hanson.pdf
    • http://loaminoo.linkpc.net/1094091091/Lair-of-Dreams-The-Diviners-2-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/8096093094096094/The-Diviners---Die-dunklen-Schatten-der-Tr-ume-Roman-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/8096093094096095/The-Diviners-Leseprobe-Aller-Anfang-ist-b-se-Roman-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/1091094097090092093/House-of-Diviners-The-Diviners-1-by-Alesha-Escobar.pdf
    • http://loaminoo.linkpc.net/1093099097090094/The-Diviners-by-Margaret-Laurence.pdf
    • http://loaminoo.linkpc.net/4091096092098/The-Diviners-by-Margaret-Laurence.pdf
    • http://loaminoo.linkpc.net/2095092099091/Beauty-Queens-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/8096093094093090/Eternal-Kiss-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/8096093094092095/Rebel-Angels-Part-B-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/8096093094092099/Rebel-Angels-Part-A-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/3092095090095/A-Great-and-Terrible-Beauty-Gemma-Doyle-1-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/2096094094099097/A-Great-and-Terrible-Beauty-Gemma-Doyle-1-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/8096093093098097/Novels-by-Libba-Bray-List-of-Gemma-Doyle-Trilogy-Characters-by-Books-LLC.pdf
    • http://loaminoo.linkpc.net/8096093093097098/The-Gemma-Doyle-Trilogy-Gemma-Doyle-1-3-by-Libba-Bray.pdf
    • http://loaminoo.linkpc.net/8096093093098092/Mornings-with-Libba-by-Reagan-Ross.pdf
    • http://loaminoo.linkpc.net/8096093094092093/Fenton-s-Leap-by-Libba-Moore-Gray.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.