Malicious PDF — malware analysis report

Static analysis result for SHA-256 e64836d4e1c4b452…

MALICIOUS

PDF

18.6 KB Created: 2019-05-06 16:53:23 +01:00 Authoring application: mPDF 5.7
MD5: d214b5f734d8401fc8fda324d097e4c1 SHA-1: 8df2072b8d580d4b3573fd12baee47044643aa47 SHA-256: e64836d4e1c4b452e0e0c8bac4639cb46edcd888616d822156f384e706ea0442
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links pointing to external PDF documents, many of which are hosted on the suspicious domain 'loaminoo.linkpc.net'. This behavior is indicative of a link farm or a redirection scheme designed to lead users to potentially malicious content. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern beyond the link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9098093090093094/Fire-Wolf-Dallas-Fire-amp-Rescue-Black-Mesa-Wolves-8-by-J-K-Harper.pdf
    • http://loaminoo.linkpc.net/7090094095091097/Alpha-Wolf-Black-Mesa-Wolves-2-by-J-K-Harper.pdf
    • http://loaminoo.linkpc.net/9098092099093092/Hunting-Wolf-Black-Mesa-Wolves-3-by-J-K-Harper.pdf
    • http://loaminoo.linkpc.net/6096099094097096/Ablaze-Dallas-Fire-amp-Rescue-2-by-Paige-Tyler.pdf
    • http://loaminoo.linkpc.net/6096099094092091/Rekindled-Dallas-Fire-amp-Rescue-1-by-Paige-Tyler.pdf
    • http://loaminoo.linkpc.net/8096093091092/Novels-by-Chris-D-lacey-The-Fire-Eternal-Fire-Star-the-Fire-Within-Icefire-the-Last-Dragon-Chronicles-Fire-World-by-Books-LLC.pdf
    • http://loaminoo.linkpc.net/4097094096092/The-Last-Dragon-Chronicles-Complete-Set-Books-1-5-The-Fire-Within-Icefire-Fire-Star-The-Fire-Eternal-and-Dark-Fire-5-Book-Set-by-Chris-d-39-Lacey.pdf
    • http://loaminoo.linkpc.net/4092093096091096/Fire-with-Fire-New-Female-Power-and-How-It-Will-Change-the-Twenty-First-Century-by-Naomi-Wolf.pdf
    • http://loaminoo.linkpc.net/4092097095096099/New-Scotia-Pack-Box-Set-Shield-Wolf-Wolf-Lover-Fire-Wolf-by-Victoria-Danann.pdf
    • http://loaminoo.linkpc.net/5098097099099090/Firefighter-Pegasus-Fire-amp-Rescue-Shifters-2-by-Zoe-Chant.pdf
    • http://loaminoo.linkpc.net/4092097095096092/Firefighter-Dragon-Fire-amp-Rescue-Shifters-1-by-Zoe-Chant.pdf
    • http://loaminoo.linkpc.net/5098097099098097/Firefighter-Sea-Dragon-Fire-amp-Rescue-Shifters-4-by-Zoe-Chant.pdf
    • http://loaminoo.linkpc.net/5098097099099091/Firefighter-Griffin-Fire-amp-Rescue-Shifters-3-by-Zoe-Chant.pdf
    • http://loaminoo.linkpc.net/2090094097094093/I-Bring-the-Fire-Part-I-Wolves-by-C-Gockel.pdf
    • http://loaminoo.linkpc.net/4092097097095094/Fire-in-the-Smokies-Durham-Wolves-2-by-Becca-Jameson.pdf
    • http://loaminoo.linkpc.net/2097092090092093/Trial-by-Fire-Raised-by-Wolves-2-by-Jennifer-Lynn-Barnes.pdf
    • http://loaminoo.linkpc.net/3096091099091090/Trial-by-Fire-Raised-by-Wolves-2-by-Jennifer-Lynn-Barnes.pdf
    • http://loaminoo.linkpc.net/4094097096098097/The-Great-Fire-One-American-s-Mission-to-Rescue-Victims-of-the-20th-Century-s-First-Genocide-by-Lou-Ureneck.pdf
    • http://loaminoo.linkpc.net/2099099099090090/The-Fire-of-a-Lone-Wolf-s-Heart-Lone-Wolf-Pack-Ripples-3-by-Anya-Byrne.pdf
    • http://loaminoo.linkpc.net/3090094091093096/Fire-Wolf-by-Anh-Leod.pdf
    • http://loaminoo.linkpc.net/4097094096092/The-Last-Dragon-Chronicles-Complete

Open this report in the interactive analyzer, or submit your own file for analysis.