Malicious PDF — malware analysis report

Static analysis result for SHA-256 e729d61e2253d339…

MALICIOUS

PDF

15.8 KB Created: 2019-04-30 04:09:27 +01:00 Authoring application: mPDF 5.7
MD5: 2e6056cf779e318579df8753fc714b2b SHA-1: b575d6d2b9ff60471596e98f593bc8bbcbb17d1f SHA-256: e729d61e2253d33946c0f8dd384c4a30f741c9f36d00411364d2e10292b8aa10
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, many of which point to URLs structured like book titles, suggesting a potential SEO manipulation or phishing lure. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with numerous external links, including the first IOC listed. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.li
    • http://loaminoo.linkpc.net/1091099090091097098/Hidden-Lives-Secret-Gardens-The-Florentine-Villas-Gamberaia-La-Pietra-and-I-Tatti-by-Terry-Schnadelbac-R-Terry-Schnadelbach.pdf
    • http://loaminoo.linkpc.net/9094092095099099/Nanny-Oggs-Kochbuch-Ein-berraschend-n-tzlicher-Almanach-mit-erstaunlichen-Rezepten-aus-Terry-Pratchetts-Scheibenwelt-by-Terry-Pratchett.pdf
    • http://loaminoo.linkpc.net/8099093098090/The-Secret-of-the-Sword-The-Sword-of-Shannara-3-by-Terry-Brooks.pdf
    • http://loaminoo.linkpc.net/4096095091098092/Terry-Pratchett-s-Mort-by-Terry-Pratchett.pdf
    • http://loaminoo.linkpc.net/8093098092091091/Clark-The-Autobiography-of-Clark-Terry-by-Clark-Terry.pdf
    • http://loaminoo.linkpc.net/7091090092092091/A-Bit-about-This-and-That-by-Terry-Dashner.pdf
    • http://loaminoo.linkpc.net/1096096090094090/The-USA-by-Terry-Deary.pdf
    • http://loaminoo.linkpc.net/3090093092092090/The-Runaway-by-Terry-Kay.pdf
    • http://loaminoo.linkpc.net/1098096091096094/The-Art-of-Discworld-by-Terry-Pratchett.pdf
    • http://loaminoo.linkpc.net/9091095093093095/Son-of-the-Morrigan-by-Terry-Unger.pdf
    • http://loaminoo.linkpc.net/8099091093093095/Damon-by-C-Terry-Cline-Jr-.pdf
    • http://loaminoo.linkpc.net/1090094094094094098/Faith-and-You-by-Terry-Pluto.pdf
    • http://loaminoo.linkpc.net/4099093091097095/After-Theory-by-Terry-Eagleton.pdf
    • http://loaminoo.linkpc.net/3093093093094092/Dodger-by-Terry-Pratchett.pdf
    • http://loaminoo.linkpc.net/2090096091096097/Taken-By-The-Team-by-Terry-Towers.pdf
    • http://loaminoo.linkpc.net/1091098092091090099/Mort-by-Terry-Pratchett.pdf
    • http://loaminoo.linkpc.net/5096092092094093/Elevation-by-Terry-Tripp.pdf
    • http://loaminoo.linkpc.net/1096098095091098/To-Dance-with-the-White-Dog-by-Terry-Kay.pdf
    • http://loaminoo.linkpc.net/1092095095092097/Warrior-by-Terry-Irving.pdf
    • http://loaminoo.linkpc.net/5098093096092097/Olivier-by-Terry-Coleman.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.