Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee61f8a55ef8383a…

MALICIOUS

PDF

15.5 KB Created: 2019-05-02 07:01:09 +01:00 Authoring application: mPDF 5.7
MD5: 2574d0a508f2d7c164ce401b089de4fb SHA-1: 0b1955aaa07334c51799824e0c4df8386c602933 SHA-256: ee61f8a55ef8383a4fc81e00179c967d8089d9fc9d6c3160ac89e82ddb209d9c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, hosted on the dynamic DNS domain 'loaminoo.linkpc.net'. This behavior is indicative of SEO poisoning or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8096097092091/Kick-Ass-Kick-Ass-1-by-Mark-Millar.pdf
    • http://loaminoo.linkpc.net/1098095095092090/Yaqui-Resistance-and-Survival-The-Struggle-for-Land-and-Autonomy-1821-1910-by-Evelyn-Hu-DeHart.pdf
    • http://loaminoo.linkpc.net/1096098092095090/Mesilithia-1-by-K-D-Delgado.pdf
    • http://loaminoo.linkpc.net/1094097095/Kick-Push-Kick-Push-1-by-Jay-McLean.pdf
    • http://loaminoo.linkpc.net/4094091096090099/Age-of-Reptiles-The-Hunt-by-Ricardo-Delgado.pdf
    • http://loaminoo.linkpc.net/3091096098092095/Lost-in-Autumn-by-Frankie-Delgado.pdf
    • http://loaminoo.linkpc.net/7099095090095092/La-eterna-tiran-a-del-tiempo-by-Publio-Delgado.pdf
    • http://loaminoo.linkpc.net/6095099090092/The-Philippine-Forest-Our-Living-Heritage-by-Karla-P-Delgado.pdf
    • http://loaminoo.linkpc.net/7099092091097090/Loyalty-amp-Respect-Nico-s-Story-by-Drea-Delgado.pdf
    • http://loaminoo.linkpc.net/1090095091093098095/Sex-and-the-medina-by-Leila-B-.pdf
    • http://loaminoo.linkpc.net/8090094099093093/Caso-313-Amor-Conspiraci-n-amp-Extraterrestres-by-Carlos-Alfredo-Delgado-Petersen.pdf
    • http://loaminoo.linkpc.net/1093090090094098/Waterfront-The-Illustrated-Maritime-History-of-Greater-Vancouver-by-James-P-Delgado.pdf
    • http://loaminoo.linkpc.net/1094093097097095/Mango-Abuela-and-Me-by-Meg-Medina.pdf
    • http://loaminoo.linkpc.net/1090095091093097096/Medina-by-Mary-McCarthy.pdf
    • http://loaminoo.linkpc.net/2098091095098/Cantora-by-Sylvia-L-pez-Medina.pdf
    • http://loaminoo.linkpc.net/4098098096090097/The-Dirty-Version-by-Medina-Faris.pdf
    • http://loaminoo.linkpc.net/3090095095098099/Bringing-Out-the-Beast-by-Marie-Medina.pdf
    • http://loaminoo.linkpc.net/7093091096094091/Broke-Baroque-by-Tony-Medina.pdf
    • http://loaminoo.linkpc.net/4099095099096097/With-the-Boys-in-the-Band-by-Marie-Medina.pdf
    • http://loaminoo.linkpc.net/4091094092097094/El-jabeque-Murciano-Operaciones-en-Argel-Una-saga-marinera-espa-ola-n-4-by-Luis-Delgado-Ba-n.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.