Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5ab1b9a31317b40…

MALICIOUS

PDF

20.8 KB Created: 2019-05-06 17:52:58 +01:00 Authoring application: mPDF 5.7
MD5: aeb9caea3cf9d62e5660b8f21d16602e SHA-1: 3f44da451550692d5e4bc952f30cb48b48b74638 SHA-256: f5ab1b9a31317b40073587871d068814a5a4f4763906e7c41459691fe1c61e10
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDFs hosted on the domain 'loaminoo.linkpc.net'. This pattern is indicative of SEO poisoning or a link farm designed to distribute malicious content or lead users to phishing sites. While the specific intent of the linked PDFs is unclear, the sheer volume and the use of a dynamic DNS hostname suggest a malicious operation. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5099099098090096/La-Brigade-du-rire-by-G-rard-Mordillat.pdf
    • http://loaminoo.linkpc.net/7095094090094096/Mini-C-est-pour-rire-8-Sp-cial-b-tisier-Plus-de-400-perles-de-ouf-Mort-de-rire-by-Claude-Mocchi.pdf
    • http://loaminoo.linkpc.net/7095096095095096/Yoga-Du-Rire-Rire-Sans-Raison-by-Madan-Kataria.pdf
    • http://loaminoo.linkpc.net/7095096095095099/RIRE-SHOSETSU-by-SAITO-HIROSHI.pdf
    • http://loaminoo.linkpc.net/7095096093098091/Peut-on-encore-rire-de-tout-by-Cabu.pdf
    • http://loaminoo.linkpc.net/6099090097096092/Un-condamn-rire-s-est-chapp-by-Pascal-Fioretto.pdf
    • http://loaminoo.linkpc.net/7093096095092091/--Bur-tasu-No-Shinz-Kanzen-Hanzai-Satsujin-Rir-by-Keigo-Higashino.pdf
    • http://loaminoo.linkpc.net/7094094097093092/The-Brigade-by-H-A-Covington.pdf
    • http://loaminoo.linkpc.net/7094094097093091/The-Bad-Ass-Brigade-by-Taylor-Lee.pdf
    • http://loaminoo.linkpc.net/2097098097098096/In-the-Irish-Brigade-by-G-A-Henty.pdf
    • http://loaminoo.linkpc.net/5097094095096099/Paravents-Et-Tr-teaux-Fantaisies-de-Salon-Et-de-Th-atre-Le-Chapeau-Le-Fou-Rire-on-Dansera-Si-j-tais-Femme-Les-crevisses-Elle-Est-Jolie-La-Gervaise-La-Farce-de-la-Cornette-Etc-Etc-by-Jacques-Normand.pdf
    • http://loaminoo.linkpc.net/5097094095098098/Paravents-Et-Tr-teaux-Fantaisies-de-Salon-Et-de-Th-atre-Le-Chapeau-Le-Fou-Rire-on-Dansera-Si-j-tais-Femme-Les-crevisses-Elle-Est-Jolie-La-Gervaise-La-Farce-de-la-Cornette-Etc-Etc-by-Jacques-Normand.pdf
    • http://loaminoo.linkpc.net/5092099091092098/Vigilante-La-Brigade-Juive-1-by-Marvano.pdf
    • http://loaminoo.linkpc.net/2096098098091091/The-Loose-Lip-Brigade-by-Julia-Newman.pdf
    • http://loaminoo.linkpc.net/7094094098092094/The-Orphan-Brigade-by-William-C-Davis.pdf
    • http://loaminoo.linkpc.net/6098096091098093/History-of-Kershaw-s-Brigade-by-D-Dickert.pdf
    • http://loaminoo.linkpc.net/7094094097098098/The-Stonewall-Brigade-by-James-I-Robertson-Jr-.pdf
    • http://loaminoo.linkpc.net/7094094098096099/The-Orphans-Brigade-by-Mike-Evans.pdf
    • http://loaminoo.linkpc.net/6097091091090097/Emission-Diffusee-Sur-France-2-Intervilles-Telethon-En-France-on-N-Demande-Qu-a-En-Rire-N-Oubliez-Pas-Les-Paroles-Faites-Entrer-L-Accuse-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/3097091090093095/The-Irish-Brigade-by-David-Power-Conyngham.pdf
    • http://loaminoo.linkpc.net/7094094097093091/The-Bad-Ass-Brigade-by-Taylor-Lee