Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed8b77e1a41da5e3…

MALICIOUS

PDF

13.1 KB Created: 2019-04-30 03:55:46 +01:00 Authoring application: mPDF 5.7
MD5: 0667f8fb76cc40e9d50f7d2ce8a89303 SHA-1: 58386164a32dce5b8ca7874e2ba9e56a3f05fe3f SHA-256: ed8b77e1a41da5e399e20fd9db648008a71e53ca33682b0309ccf5f43f98420a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded URLs, forming a link farm. These URLs point to external PDF files hosted on 'loaminoo.linkpc.net', suggesting a distribution or redirection mechanism. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9006

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3095092096093097/Trail-of-Hope-Hot-on-the-Trail-2-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/3095092096093093/Trail-of-Kisses-Hot-on-the-Trail-1-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/1098091097095/Trail-of-Hope-Story-of-the-Mormon-Trail-by-William-W-Slaughter.pdf
    • http://loaminoo.linkpc.net/1095090099096094/Trail-of-Hope-by-Dan-Vanderburg.pdf
    • http://loaminoo.linkpc.net/2098095092094098/Trail-of-the-Raven-Haiti-Trail-of-the-Raven-1-by-Chip-Davis.pdf
    • http://loaminoo.linkpc.net/2091099099097099/The-Trail-West-The-Trail-West-1-by-William-W-Johnstone.pdf
    • http://loaminoo.linkpc.net/3099098090093091/In-Your-Arms-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/6094095096094099/Somebody-to-Love-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/3099096091092091/The-Faithful-Heart-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/6094095095098098/His-Bewildering-Bride-The-Brides-of-Paradise-Ranch-3-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/3099098097097098/December-Heart-The-Silver-Foxes-of-Westminster-1-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/6094095096093096/His-Heartbroken-Bride-The-Brides-of-Paradise-Ranch-4-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/6094095096094091/Holly-The-Christmas-Bride-The-Brides-of-Paradise-Ranch-9-by-Merry-Farmer.pdf
    • http://loaminoo.linkpc.net/4099092098094090/The-End-of-the-Trail-by-Louis-Rakovich.pdf
    • http://loaminoo.linkpc.net/8090096099094096/The-Trail-to-San-Triste-by-Max-Brand.pdf
    • http://loaminoo.linkpc.net/3098092095090095/The-Trail-by-Meika-Hashimoto.pdf
    • http://loaminoo.linkpc.net/5097093093099/Blood-Trail-Joe-Pickett-8-by-C-J-Box.pdf
    • http://loaminoo.linkpc.net/4092090099093091/Trouble-Trail-by-Max-Brand.pdf
    • http://loaminoo.linkpc.net/1091098094096094095/The-Vodka-Trail-by-A-A-Abbott.pdf
    • http://loaminoo.linkpc.net/1091097093094094097/The-Panama-Hat-Trail-by-Tom-Miller.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.