Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9430cc3e81c65e6…

MALICIOUS

PDF

16.3 KB Created: 2019-05-01 17:36:20 +01:00 Authoring application: mPDF 5.7
MD5: f6b6e723b20463a3aac92e54464c1ffc SHA-1: 659d6c92ff774a2a745bfe0bb635ad9c88195912 SHA-256: d9430cc3e81c65e6276209ab0276a84a71b6de0d68c2a2d6327b2102280371fe
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDFs hosted on the domain 'loaminoo.linkpc.net'. This behavior is indicative of a link farm or a redirection scheme designed to lead users to potentially malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090098099098090095/Hubble-15-Jahre-auf-Entdeckungsreise-by-Lars-Lindberg-Christensen.pdf
    • http://loaminoo.linkpc.net/2095090093092091/Birdie-by-M-C-Carr.pdf
    • http://loaminoo.linkpc.net/3091099094091093/Woof-Bowser-and-Birdie-1-by-Spencer-Quinn.pdf
    • http://loaminoo.linkpc.net/2099092091093/Birdie-Abercrombie-Trail-3-by-Candace-Simar.pdf
    • http://loaminoo.linkpc.net/5090095091095/The-Gambler-King-of-Clark-Street-Michael-C-McDonald-and-the-Rise-of-Chicago-s-Democratic-Machine-by-Richard-C-Lindberg.pdf
    • http://loaminoo.linkpc.net/1090095094093093/Look-at-the-Birdie-Unpublished-Short-Fiction-by-Kurt-Vonnegut.pdf
    • http://loaminoo.linkpc.net/2091099092091096/The-Inevitable-Collision-of-Birdie-amp-Bash-by-Candace-Ganger.pdf
    • http://loaminoo.linkpc.net/1098095092099096/Calvin-Can-t-Fly-The-Story-of-a-Bookworm-Birdie-by-Jennifer-Berne.pdf
    • http://loaminoo.linkpc.net/4093092091097093/Heartland-Serial-Killers-Belle-Gunness-Johann-Hoch-and-Murder-for-Profit-in-Gaslight-Era-Chicago-by-Richard-C-Lindberg.pdf
    • http://loaminoo.linkpc.net/5096098094092090/My-Tiny-Vegas-Life-Between-the-Sangre-de-Christo-Mountains-and-the-Great-Plains-by-Birdie-Jaworski.pdf
    • http://loaminoo.linkpc.net/1092096090091095/Esker-by-D-L-Tracey.pdf
    • http://loaminoo.linkpc.net/1090099094091093/Not-in-This-World-by-Tracey-Herd.pdf
    • http://loaminoo.linkpc.net/2096090099095090/Bite-Me-Vol-2-by-Tracey-H-Kitts.pdf
    • http://loaminoo.linkpc.net/2094099092095090/Taking-Joy-by-Jordyn-Tracey.pdf
    • http://loaminoo.linkpc.net/4091092094092098/Eternally-Yours-by-Tracey-H-Kitts.pdf
    • http://loaminoo.linkpc.net/1092091096095091/Lark-by-Tracey-Porter.pdf
    • http://loaminoo.linkpc.net/2091098097091097/Bitten-by-Tracey-H-Kitts.pdf
    • http://loaminoo.linkpc.net/7096094097091099/Zinfandelity-by-Tracey-Sorel.pdf
    • http://loaminoo.linkpc.net/2091091097090099/Christmas-with-You-Due-South-4-by-Tracey-Alvarez.pdf
    • http://loaminoo.linkpc.net/4091097098093095/A-Flower-in-the-Snow-by-Tracey-Corderoy.pdf
    • http://loaminoo.linkpc.net/4093092091097093/Heartland-Serial-Killer

Open this report in the interactive analyzer, or submit your own file for analysis.