Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4eb52667d8b5d0d…

MALICIOUS

PDF

15.3 KB Created: 2019-05-01 17:25:13 +01:00 Authoring application: mPDF 5.7
MD5: 2f9d969c0564b33e252affb716630e35 SHA-1: 9a2812cea5d1d0a33bdef67da213e6b15140f66c SHA-256: f4eb52667d8b5d0de28b10d94796cc3b75c1999bb494a05724c212a78116bbe6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, primarily hosted on the domain 'loaminoo.linkpc.net'. This behavior is indicative of a link farm or a redirection scheme designed to lead users to potentially malicious content. The ML classifier also flagged this PDF as malicious with a high probability. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.li
    • http://loaminoo.linkpc.net/9092098091099090/Little-Women-Little-Women-1-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/5096099099098094/Little-Women-Little-Women-1-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/8092097092095093/Little-Women-Little-Women-1-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/9090099091092/The-Complete-Little-Women-Series-Little-Women-Good-Wives-Little-Men-Jo-s-Boys-The-Beloved-Classics-of-American-Literature-The-coming-of-age-series-experiences-with-her-three-sisters-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/4090095095090096/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/5095094090095/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/4096098093092097/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/6091095091090094/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/6090097094095097/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/5095090097091099/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/6094097096099090/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/3094097099095099/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/7092096092097095/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/1090095092091092093/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/6092098091091091/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/4090094091090090/Little-Men-Little-Women-2-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/6093094096090098/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/3092091092090/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/9091097094097094/Little-Women-by-Louisa-May-Alcott.pdf
    • http://loaminoo.linkpc.net/5096097098095091/Little-Women-by-Louisa-May-Alcott.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.