Malicious PDF — malware analysis report

Static analysis result for SHA-256 e61a6f842fbe8411…

MALICIOUS

PDF

12.5 KB Created: 2019-04-28 10:14:07 +01:00 Authoring application: mPDF 5.7
MD5: cdcb932eea17070d29c0c8c0a919b72a SHA-1: 561122008340882f9e9ad7f78ecd4516fa3eb16f SHA-256: e61a6f842fbe8411e9d334ca152a81d7e512f1ddba2ab8eb0c193e097e19916e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, all hosted on the domain 'loaminoo.linkpc.net'. This pattern is indicative of a link farm designed to deceive users into clicking through to potentially malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8780

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1098099099097/In-One-Person-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/3094093091091/Until-I-Find-You-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1091099091091099092/Hotel-New-Hampshire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/9097099098093094/The-World-According-To-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/2097092099094093/The-World-According-to-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1099090094099095/Das-Hotel-New-Hampshire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1098097092092097/The-Hotel-New-Hampshire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/4090091092095091/The-World-According-to-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/4090099096094/The-Fourth-Hand-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/3098091090091099/The-World-According-to-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/6091094096099094/En-b-n-f-r-Owen-Meany-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1098097092099090/The-Imaginary-Girlfriend-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/3096092093092094/The-World-According-to-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/7093099097093091/Hotel-New-Hampshire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/9093099090096092/En-b-nn-for-Owen-Meany-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/7096091091099092/La-Petite-Amie-imaginaire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1090097096097098097/My-Movie-Business-A-Memoir-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/5098090097092093/Un-mariage-poids-moyen-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/5098090096097098/Le-Monde-selon-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/4090091091093097/A-Prayer-for-Owen-Meany-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/9093099090096092/En-b-nn-for-Owen

Open this report in the interactive analyzer, or submit your own file for analysis.