Malicious PDF — malware analysis report

Static analysis result for SHA-256 efd7a64844d04ffa…

MALICIOUS

PDF

12.1 KB Created: 2019-05-01 05:24:40 +01:00 Authoring application: mPDF 5.7
MD5: b426a6e5e92454412165be0c4bb0b12c SHA-1: 167a149f208e863cd35818f0457eaecde7970a60 SHA-256: efd7a64844d04ffa5d2dcc7ff882ab95a148ba822bd05ec65947ea8d87689cfc
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files hosted on loaminoo.linkpc.net. While the URLs themselves are marked as confirmed benign, the sheer volume and structure suggest a link farm or a distribution mechanism for potentially malicious content. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8737

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3090096092090096/Man-Candy-Candy-1-by-Amanda-Young.pdf
    • http://loaminoo.linkpc.net/4092090091095098/Eye-Candy-Candy-3-by-Amanda-Young.pdf
    • http://loaminoo.linkpc.net/4090090092093/L-A-Candy-L-A-Candy-1-by-Lauren-Conrad.pdf
    • http://loaminoo.linkpc.net/5095098096095092/I-Want-Candy-by-Susan-Donovan.pdf
    • http://loaminoo.linkpc.net/3091093095099098/The-Awakening-by-Candy-Crum.pdf
    • http://loaminoo.linkpc.net/2099098090099094/Ice-Candy-Man-by-Bapsi-Sidhwa.pdf
    • http://loaminoo.linkpc.net/4091093097091092/Hard-Candy-by-S-J-Davis.pdf
    • http://loaminoo.linkpc.net/3098092093098096/Candy-Corn-by-Bea-Sloboder.pdf
    • http://loaminoo.linkpc.net/6095092097099/Eye-Candy-by-Frederick-Germaine.pdf
    • http://loaminoo.linkpc.net/2094094094096095/Shine-by-Candy-Gourlay.pdf
    • http://loaminoo.linkpc.net/3094096096/Man-Candy-by-Melanie-Harlow.pdf
    • http://loaminoo.linkpc.net/1090093096094094/Candy-Licker-by-Noire.pdf
    • http://loaminoo.linkpc.net/4090094097099/Candy-by-Kevin-Brooks.pdf
    • http://loaminoo.linkpc.net/8091093098092/Gym-Candy-by-Carl-Deuker.pdf
    • http://loaminoo.linkpc.net/9096090090093095/The-Candy-Floss-Head-by-Bev-Jessop.pdf
    • http://loaminoo.linkpc.net/4095099090090097/Candy-Girl-by-Karen-McCombie.pdf
    • http://loaminoo.linkpc.net/4095098092097092/L-A-Candy-Boxed-Set-by-Lauren-Conrad.pdf
    • http://loaminoo.linkpc.net/3094091094095090/Candy-Store-by-Bella-Andre.pdf
    • http://loaminoo.linkpc.net/4091093090094097/Best-Friends-with-Benefits-Most-Likely-To-1-by-Candy-Sloane.pdf
    • http://loaminoo.linkpc.net/9090098093091090/Candy-Counting-by-Lisa-McCourt.pdf
    • http://loaminoo.linkpc.net/9

Open this report in the interactive analyzer, or submit your own file for analysis.