Malicious PDF — malware analysis report

Static analysis result for SHA-256 f03b19e5539bfbb7…

MALICIOUS

PDF

16.8 KB Created: 2019-05-07 08:35:44 +01:00 Authoring application: mPDF 5.7
MD5: b14462a4858e3414aab2c972363f944c SHA-1: 68577252651378a42c455603b601850fa83c63ad SHA-256: f03b19e5539bfbb713ee4b591650268902b7635abbf796bcf718f47f0e3d0de1
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, forming a link farm. The primary heuristic indicates this is a PDF SEO link farm, suggesting the document's purpose is to redirect users to a network of other PDF files hosted on loaminoo.linkpc.net. No scripts were extracted, and the document body was heavily obfuscated, but the presence of numerous links points to a redirection or content-discovery attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1099094097098096/The-Pretty-App-App-2-by-Katie-Sise.pdf
    • http://loaminoo.linkpc.net/1099095096092094/The-Academy-by-Katie-Sise.pdf
    • http://loaminoo.linkpc.net/1094095098093099/Pretty-Little-Werewolf-Little-Werewolf-1-by-Katie-Salidas.pdf
    • http://loaminoo.linkpc.net/2093090094093093/Pretty-is-as-Pretty-Dies-Myrtle-Clover-Mysteries-1-by-Elizabeth-Spann-Craig.pdf
    • http://loaminoo.linkpc.net/1090097098090096098/Pretty-Little-Ghost-Pretty-Little-Liars-Rosewood-Hotel-Mystery-2-by-M-B-Borchardt.pdf
    • http://loaminoo.linkpc.net/5094093094099098/All-Things-Pretty-Part-Two-Pretty-3-5-by-Michelle-Leighton.pdf
    • http://loaminoo.linkpc.net/2099097094096092/Pretty-New-Doll-Pretty-Little-Dolls-3-by-Ker-Dukey.pdf
    • http://loaminoo.linkpc.net/4092090094094094/Pretty-Hot-Pretty-1-by-Donna-Alam.pdf
    • http://loaminoo.linkpc.net/9098094095/Chocolate-Covered-Katie-Over-80-Delicious-Recipes-That-Are-Secretly-Good-for-You-by-Katie-Higgins.pdf
    • http://loaminoo.linkpc.net/3097096092095098/Katie-s-Hellion-amp-Katie-s-Hope-Rhyn-Trilogy-1-2-by-Lizzy-Ford.pdf
    • http://loaminoo.linkpc.net/2097099093095099/Pretty-Guardian-Sailor-Moon-Vol-3-Pretty-Soldier-Sailor-Moon-Renewal-Edition-3-by-Naoko-Takeuchi.pdf
    • http://loaminoo.linkpc.net/4094097094099/Pretty-Guardian-Sailor-Moon-Vol-1-Pretty-Soldier-Sailor-Moon-Renewal-Edition-1-by-Naoko-Takeuchi.pdf
    • http://loaminoo.linkpc.net/4095091094/Pretty-Lost-Dolls-Pretty-Little-Dolls-2-by-Ker-Dukey.pdf
    • http://loaminoo.linkpc.net/5094093094093098/Pretty-Broken-Dolls-Pretty-Little-Dolls-4-by-Ker-Dukey.pdf
    • http://loaminoo.linkpc.net/3090093092096096/Pretty-Crooked-Pretty-Crooked-1-by-Elisa-Ludwig.pdf
    • http://loaminoo.linkpc.net/3091095093094099/Katie-and-the-Mustang-Book-1-Hoofbeats-Katie-and-the-Mustang-1-by-Kathleen-Duey.pdf
    • http://loaminoo.linkpc.net/5094093094091098/Pretty-in-Black-Pretty-in-Black-1-by-Rae-Hachton.pdf
    • http://loaminoo.linkpc.net/2098095095096093/Pretty-In-Black-Pretty-in-Black-1-by-Rae-Hachton.pdf
    • http://loaminoo.linkpc.net/1099099093090090/Pretty-In-Black-Pretty-in-Black-1-by-Rae-Hachton.pdf
    • http://loaminoo.linkpc.net/1090099096092093097/Katie-and-the-Mustang-Hoofbeats-Katie-and-the-Mustang-4-by-Kathleen-Duey.pdf
    • http://loaminoo.linkpc.net/2097099093095099/Pretty-Guardian-Sail

Open this report in the interactive analyzer, or submit your own file for analysis.