Malicious PDF — malware analysis report

Static analysis result for SHA-256 efe7707df5b90b35…

MALICIOUS

PDF

14.7 KB Created: 2019-05-07 03:17:34 +01:00 Authoring application: mPDF 5.7
MD5: ac5957507088729a32254aac68d530ea SHA-1: 205a75e70e108e76d200ee57bece0b5575769662 SHA-256: efe7707df5b90b352aa6db445a6477619b03146a693d5a0bb965122cf49bfade
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on the domain 'loaminoo.linkpc.net'. This is indicative of a link farm or SEO poisoning attack, designed to drive traffic to specific content, potentially as a lure for further malicious activity. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.link
    • http://loaminoo.linkpc.net/2097090096092090/The-Centrality-of-Jesus-Christ-Works-of-T-Austin-Sparks-Volume-One-by-T-Austin-Sparks.pdf
    • http://loaminoo.linkpc.net/5092094094098096/Alberto-Vargas-Works-from-the-Max-Vargas-Collection-by-Reid-Stewart-Austin.pdf
    • http://loaminoo.linkpc.net/3098090095091092/Become-the-Woman-of-Your-Dreams-Interactive-Gender-Transformation-Feminization-Erotica-Aurora-Sparks-Interactive-Erotica-1-by-Aurora-Sparks.pdf
    • http://loaminoo.linkpc.net/6098090099094092/Zos-Speaks-Encounters-with-Austin-Osman-Spare-by-Austin-Osman-Spare.pdf
    • http://loaminoo.linkpc.net/9099096095096/More-by-Austin-Clarke.pdf
    • http://loaminoo.linkpc.net/9096097091099093/Verstehen-by-Bob-Austin.pdf
    • http://loaminoo.linkpc.net/3093097090092/The-Best-of-Me-by-Nicholas-Sparks.pdf
    • http://loaminoo.linkpc.net/1093095092097099/Two-by-Two-by-Nicholas-Sparks.pdf
    • http://loaminoo.linkpc.net/1098090093/See-Me-by-Nicholas-Sparks.pdf
    • http://loaminoo.linkpc.net/2098099094092097/Hot-Commodity-by-M-J-Sparks.pdf
    • http://loaminoo.linkpc.net/5099093091092092/Two-by-Two-by-Nicholas-Sparks.pdf
    • http://loaminoo.linkpc.net/9098092098095095/Sparks-by-R-S-McCoy.pdf
    • http://loaminoo.linkpc.net/5090092093094095/The-Best-of-Me-by-Nicholas-Sparks.pdf
    • http://loaminoo.linkpc.net/3091092091093099/The-Eye-of-Osiris-by-R-Austin-Freeman.pdf
    • http://loaminoo.linkpc.net/1099094094091090/How-to-Do-Things-with-Words-by-J-L-Austin.pdf
    • http://loaminoo.linkpc.net/2099099098090092/Our-Paradise-by-Austin-Bates.pdf
    • http://loaminoo.linkpc.net/3090095092091097/The-Mystery-of-31-New-Inn-by-R-Austin-Freeman.pdf
    • http://loaminoo.linkpc.net/3094090094098098/Coffee-Boy-by-Austin-Chant.pdf
    • http://loaminoo.linkpc.net/2095099098098092/Believe-in-Me-by-Mishael-Austin-Witty.pdf
    • http://loaminoo.linkpc.net/3090095099090/My-Bad-Tequila-by-Rico-Austin.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.