Malicious PDF — malware analysis report

Static analysis result for SHA-256 f20b6537a123ff48…

MALICIOUS

PDF

16.2 KB Created: 2019-05-02 01:53:31 +01:00 Authoring application: mPDF 5.7
MD5: 981a096e8f4abde527797550c9cc3742 SHA-1: 4bc71b82e0a55d8cce909a7a4ffe6f9d9489b04f SHA-256: f20b6537a123ff4823cfa756ac16b8f55ceed487252ce44907473a6d8ab9b21a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a PDF_SEO_LINK_FARM heuristic firing, indicating the presence of numerous embedded links to external PDF files. The primary URL identified is http://loaminoo.linkpc.net/, which hosts a large number of book-themed PDFs. This suggests a potential SEO poisoning or link farm attack designed to lure users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2099095092091093/Donovan-s-Angel-Donovan-s-of-the-Delta-1-by-Peggy-Webb.pdf
    • http://loaminoo.linkpc.net/2097093092094092/Footprints-in-the-Sand-A-Piper-Donovan-Mystery-Piper-Donovan-Wedding-Cake-Mysteries-Book-3-by-Mary-Jane-Clark.pdf
    • http://loaminoo.linkpc.net/6098094099098095/Meurtre-Heron-s-Cove-T1---S-rie-Emma-Sharpe-et-Colin-Donovan-Emma-Sharpe-amp-Colin-Donovan-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/1093095098096/Jack-on-the-Tracks-Four-Seasons-of-Fifth-Grade-Jack-Henry-4-by-Jack-Gantos.pdf
    • http://loaminoo.linkpc.net/3096092093093095/Jack-Jack-You-Don-t-Know-Jacks-by-Jack-Gilinsky.pdf
    • http://loaminoo.linkpc.net/1091094098093090091/Chaotic-Be-Jack-A-Jack-Nolan-Novel-The-Cap-s-Place-Series-Book-5-by-Robert-Tarrant.pdf
    • http://loaminoo.linkpc.net/1091090095091092/Jack-of-Kinrowan-Jack-the-Giant-Killer-Drink-Down-the-Moon-by-Charles-de-Lint.pdf
    • http://loaminoo.linkpc.net/4090096092090095/The-Story-Of-Wild-Goose-Jack-The-Life-And-Work-Of-Jack-Miner-by-James-M-Linton.pdf
    • http://loaminoo.linkpc.net/6092099092096094/F-bulas-presenta-Jack-vol-1-La-casi-gran-evasi-n-Jack-of-Fables-1-by-Bill-Willingham.pdf
    • http://loaminoo.linkpc.net/1091099095091099090/Jack-and-the-Giant-Killer-Jack-Stratton-4-by-Christopher-Greyson.pdf
    • http://loaminoo.linkpc.net/1093091094098094/Jack-Wakes-Up-Jack-Palms-1-by-Seth-Harwood.pdf
    • http://loaminoo.linkpc.net/4090094097098096/Jack-of-Fables-Vol-2-Jack-of-Hearts-by-Bill-Willingham.pdf
    • http://loaminoo.linkpc.net/1095092091095090/What-If-by-Rebecca-Donovan.pdf
    • http://loaminoo.linkpc.net/6090091094092092/Et-si-by-Rebecca-Donovan.pdf
    • http://loaminoo.linkpc.net/3092099090090095/The-Art-of-Steampunk-by-Art-Donovan.pdf
    • http://loaminoo.linkpc.net/2098094098091090/What-If-by-Rebecca-Donovan.pdf
    • http://loaminoo.linkpc.net/2091096092093095/The-Girl-Most-Likely-To-by-Susan-Donovan.pdf
    • http://loaminoo.linkpc.net/1091096091091092/Much-Ado-About-Shakespeare-by-Donovan-Bixley.pdf
    • http://loaminoo.linkpc.net/2095094090098/Take-a-Chance-on-Me-by-Susan-Donovan.pdf
    • http://loaminoo.linkpc.net/3096092097099093/The-Bond-by-William-Donovan.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.