Malicious PDF — malware analysis report

Static analysis result for SHA-256 eefaa4d9e2e613be…

MALICIOUS

PDF

18.7 KB Created: 2019-05-02 01:29:35 +01:00 Authoring application: mPDF 5.7
MD5: 0fd672370a50ee65bfddc790a78f3c57 SHA-1: 650f693f2dacd5dfdafbecd90d48fc6b79672eda SHA-256: eefaa4d9e2e613be0c29245cd812f8ceb0e3c172456fabb30525ea940117a78e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm with 24 external links, all pointing to PDF files hosted on loaminoo.linkpc.net. This heuristic suggests a tactic to drive traffic to a large number of resources, potentially for SEO manipulation or to host malicious content. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8099097090090094/Captured-A-WW-II-Experience-of-Air-Force-P-O-W-S-in-Germany-by-Richard-A-Matheis.pdf
    • http://loaminoo.linkpc.net/8099097090091096/Captured-by-Richard-A-Matheis.pdf
    • http://loaminoo.linkpc.net/6093092095092/Captured-Moments-Inspiration-Captured-in-Verse-by-J-D-Estrada.pdf
    • http://loaminoo.linkpc.net/1091093093096094095/Germany-1945-From-War-to-Peace-by-Richard-Bessel.pdf
    • http://loaminoo.linkpc.net/9094091091098092/Germany-s-Panzer-Arm-in-World-War-II-by-Richard-L-DiNardo.pdf
    • http://loaminoo.linkpc.net/7097091097090096/He-s-Captured-my-Heart-Captured-1-by-Karen-Frances.pdf
    • http://loaminoo.linkpc.net/1094090094096090/Can-You-Feel-the-Force-by-Richard-Hammond.pdf
    • http://loaminoo.linkpc.net/1099091092099097/The-Kings-Depart-The-Tragedy-of-Germany-Versailles-and-the-German-Revolution-by-Richard-M-Watt.pdf
    • http://loaminoo.linkpc.net/4098096092099090/The-Coming-of-the-Third-Reich-How-the-Nazis-Destroyed-Democracy-and-Seized-Power-in-Germany-by-Richard-J-Evans.pdf
    • http://loaminoo.linkpc.net/2090091092096092/Germany-s-Drive-to-the-West-A-Study-of-Germany-s-War-Aims-during-the-First-World-War-by-Hans-Wilhelm-Gatzke.pdf
    • http://loaminoo.linkpc.net/1091093097098091095/Germany---The-Handbook-for-Foreign-Companies-and-Founders-For-all-entrepreneurs-and-businesses-who-are-planning-a-new-chapter-or-expansion-into-Germany-by-Yannik-S-ss.pdf
    • http://loaminoo.linkpc.net/9097090092092099/The-Federal-Constitution-of-Germany-by-Germany-Verfassung.pdf
    • http://loaminoo.linkpc.net/8099097091096099/First-Date-Mad-Libs-by-Mickie-Matheis.pdf
    • http://loaminoo.linkpc.net/8099097090099099/Jans-Abenteuer-by-Elisabeth-Matheis.pdf
    • http://loaminoo.linkpc.net/8099097090090099/Babysitting-Blues-by-Mickie-Matheis.pdf
    • http://loaminoo.linkpc.net/8099097090091097/Kai-lan-and-the-Ladybug-Festival-by-Mickie-Matheis.pdf
    • http://loaminoo.linkpc.net/8099097091096098/The-Incredibles-Mad-Libs-by-Mickie-Matheis.pdf
    • http://loaminoo.linkpc.net/8099097092096093/Edward-Scissorhands-Mad-Libs-by-Mickie-Matheis.pdf
    • http://loaminoo.linkpc.net/8099097093096096/Inverted-Edge-Tactics-How-to-cut-someone-off-of-you-by-George-F-Matheis-Jr.pdf
    • http://loaminoo.linkpc.net/6096099092099/The-Force-Unleashed-Star-Wars-The-Force-Unleashed-1-by-Sean-Williams.pdf
    • http://loaminoo.linkpc.net/4098096092099090/The-Coming-of-the-Third-Reich-How-the-Nazis-Destroy

Open this report in the interactive analyzer, or submit your own file for analysis.