Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7372b9b370aaee7…

MALICIOUS

PDF

13.7 KB Created: 2019-04-30 04:25:31 +01:00 Authoring application: mPDF 5.7
MD5: b1af835ac2e66a16ed23722ba90dfd9c SHA-1: 1205c0792583f6c1e6b35941ec2bc336e82c5a3d SHA-256: d7372b9b370aaee7598e9ec6fea0b49ede1de59f54e9525096716aef6be8ece6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm with 20 external links, predominantly pointing to book titles hosted on the 'loaminoo.linkpc.net' domain. This heuristic, combined with the ML classifier's high confidence, suggests a malicious intent to redirect users to potentially harmful content or for SEO poisoning. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6098091099091095/The-Classic-Clark-Collection-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/2096098099095/Mary-Higgins-Clark-Presents-Malice-Domestic-Malice-Domestic-2-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/2096091098096096/I-ll-Be-Seeing-You-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/2096096094093093/Where-Are-You-Now-A-Novel-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/5094098097/All-By-Myself-Alone-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/1095093098099092/A-Cry-In-The-Night-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/2096095099097097/Stillwatch-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/1098096098095093/I-ll-Walk-Alone-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/3094092090097090/Before-I-Say-Good-Bye-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/2094090098094098/Pretend-You-Don-t-See-Her-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/3098094095092090/All-Through-the-Night-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/9092094093/You-Don-t-Own-Me-Under-Suspicion-6-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/2092095093099091/Remember-Me-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/3099099095097/All-Around-the-Town-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/4096092090092/I-Heard-That-Song-Before-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/3090094095099099/While-My-Pretty-One-Sleeps-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/1099090095096096/The-Lottery-Winner-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/1095099096098091/Daddy-s-Little-Girl-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/1095093098099091/On-the-Street-Where-You-Live-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/1095093098099099/I-ve-Got-You-Under-My-Skin-Under-Suspicion-1-by-Mary-Higgins-Clark.pdf
    • http://loaminoo.linkpc.net/909209

Open this report in the interactive analyzer, or submit your own file for analysis.