Malicious PDF — malware analysis report

Static analysis result for SHA-256 f106cfb3d23b4a13…

MALICIOUS

PDF

15.9 KB Created: 2019-04-30 04:06:27 +01:00 Authoring application: mPDF 5.7
MD5: fcee48cad6eee9506b5c00a0d7f0f20d SHA-1: 7020989298e8e30941a65cba6a6f6186497265e7 SHA-256: f106cfb3d23b4a13ad41f7458631cdd3d78b77f2686e20ded2aaca1e78b54364
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a link farm containing 22 external PDF links, with the first link being http://loaminoo.linkpc.net/1091093097092099091/Every-Breath-You-Take-Billionaires-in-Disguise-Georgie-1-Rock-Stars-in-Disguise-Xan-1-by-Blair-Babylon.pdf. This suggests the document is designed to redirect users to potentially harmful content through a large number of obfuscated links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9892

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091093097092099091/Every-Breath-You-Take-Billionaires-in-Disguise-Georgie-1-Rock-Stars-in-Disguise-Xan-1-by-Blair-Babylon.pdf
    • http://loaminoo.linkpc.net/3094097092090096/Every-Breath-You-Take-Billionaires-in-Disguise-Georgie-1-Rock-Stars-in-Disguise-Xan-1-by-Blair-Babylon.pdf
    • http://loaminoo.linkpc.net/7097099097098099/Ignorant-Armies-by-Sam-Wharton.pdf
    • http://loaminoo.linkpc.net/7097099097099092/Ignorant-Bliss-by-Brendan-Lee.pdf
    • http://loaminoo.linkpc.net/7097099099091098/You-re-Not-Stupid-You-re-Ignorant-by-Lance-Hodge.pdf
    • http://loaminoo.linkpc.net/7097099097097091/Ignorant-Armies-by-David-Pringle.pdf
    • http://loaminoo.linkpc.net/7097099097099091/Ignorant-Armies-by-Karen-Alkalay-Gut.pdf
    • http://loaminoo.linkpc.net/7097099097098095/Ignorant-and-Agnostic-by-Stuart-Card.pdf
    • http://loaminoo.linkpc.net/7097099097097092/Ignorant-Souls-by-Richard-Jeanty.pdf
    • http://loaminoo.linkpc.net/7097099099092091/A-Dedication-to-the-Ignorant-and-Lazy-by-Torrey-Likey.pdf
    • http://loaminoo.linkpc.net/7097099099097099/THE-YOGA-TRAP-Be-Not-Ignorant-Of-His-Devices-by-M-Christchild.pdf
    • http://loaminoo.linkpc.net/7097099098095095/Homophobe-A-logical-response-to-an-ignorant-ideology-by-J-J-Morrow.pdf
    • http://loaminoo.linkpc.net/7097099099098098/Trying-to-Educate-USA-Economically-Ignorant-Suckers-by-Freddie-L-Sirmans-Sr-.pdf
    • http://loaminoo.linkpc.net/7097099097098096/Blessed-Are-The-Ignorant-A-Darshan-Diary-by-Prem-Maneesha.pdf
    • http://loaminoo.linkpc.net/7097099099091090/The-Ignorant-Mountaineers-of-South-Wales-by-Aeddan-Howells.pdf
    • http://loaminoo.linkpc.net/7097099099098094/Hell-s-Road-Saga-The-Ignorant-and-the-Damned-by-William-A-Gould.pdf
    • http://loaminoo.linkpc.net/7097099099099091/Ignorant-Yobs-Low-Attainers-in-a-Global-Knowledge-Economy-by-Sally-Tomlinson.pdf
    • http://loaminoo.linkpc.net/5094097093094/The-Best-Romance-Ever-by-Ina-Disguise.pdf
    • http://loaminoo.linkpc.net/6097093092094094/Vigilance-in-Disguise-by-M-L-Steele.pdf
    • http://loaminoo.linkpc.net/2094097090090090/Love-in-Disguise-by-Carol-Cox.pdf
    • http://loaminoo.linkpc.net/709709909909

Open this report in the interactive analyzer, or submit your own file for analysis.