Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7c346f12166d3b7…

MALICIOUS

PDF

38.6 KB Created: 2019-04-30 07:52:28 +01:00 Authoring application: mPDF 5.7
MD5: 07d4029e1e7504c1663a74bd90692f5e SHA-1: 5dc079d630327d92a39af27325e994e41f15dedb SHA-256: f7c346f12166d3b7e01cc70e38ec21d67f600c139d3a2f72b53176bd2a9eeeaa
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document was flagged by a machine learning classifier as malicious and contains a large number of external links, many of which are numeric slugs pointing to book-related titles. While the document body is heavily obfuscated, the presence of numerous external links suggests a potential distribution or redirection mechanism. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external link farm, with the first URL being http://loaminoo.linkpc.net/1090090090096098091/The-Godfather-and-American-Culture-How-the-Corleones-Became-quot-Our-Gang-quot-SUNY-series-in-Italian-American-Culture-by-Chris-Messenger.pdf.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9926

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090090090096098091/The-Godfather-and-American-Culture-How-the-Corleones-Became-quot-Our-Gang-quot-SUNY-series-in-Italian-American-Culture-by-Chris-Messenger.pdf
    • http://loaminoo.linkpc.net/1090090090095096093/The-Godfather-and-American-Culture-How-the-Corleones-Became-quot-our-Gang-quot-by-Christian-K-Messenger.pdf
    • http://loaminoo.linkpc.net/5090097099095097/-quot-Culture-quot-and-Culture-Traditional-Knowledge-and-Intellectual-Rights-by-Manuela-Carneiro-da-Cunha.pdf
    • http://loaminoo.linkpc.net/6090095092095091/Rabelais-and-Bakhtin-Popular-Culture-in-quot-Gargantua-and-Pantagruel-quot-by-Richard-M-Berrong.pdf
    • http://loaminoo.linkpc.net/9091091091094095/Schiller-s-quot-On-Grace-and-Dignity-quot-in-Its-Cultural-Context-Essays-and-a-New-Translation-Studies-in-German-Literature-Linguistics-and-Culture-by-Christophe-Fricker.pdf
    • http://loaminoo.linkpc.net/5094092093097099/Asterix-amp-Friends-quot-Asterix-the-Gladiator-quot-quot-Asterix-in-Switzerland-quot-quot-Mansions-of-the-Gods-quot-quot-Asterix-and-the-Laurel-Wreath-quot-quot-Obelix-and-Co-quot-by-Ren-Goscinny.pdf
    • http://loaminoo.linkpc.net/6097095091096/-quot-Evil-quot-Arabs-in-American-Popular-Film-Orientalist-Fear-by-Tim-Jon-Semmerling.pdf
    • http://loaminoo.linkpc.net/1091095093092099096/-quot-so-There-It-Is-quot-An-Exploration-of-Cultural-Hybridity-in-Contemporary-Asian-American-Poetry-by-Brigitte-Wallinger-Schorn.pdf
    • http://loaminoo.linkpc.net/7097097096095090/Taming-Democracy-quot-the-People-quot-the-Founders-and-the-Troubled-Ending-of-the-American-Revolution-by-Terry-Bouton.pdf
    • http://loaminoo.linkpc.net/5094092095095091/Soldiers-for-Sale-German-quot-Mercenaries-quot-with-the-British-in-Canada-during-the-American-Revolution-1776-83-by-Jean-Pierre-Wilhelmy.pdf
    • http://loaminoo.linkpc.net/2092096090096092/-quot-I-Do-Not-Apologize-for-the-Length-of-This-Letter-quot-The-Mari-Sandoz-Letters-on-Native-American-Rights-1940-1965-by-Kimberli-A-Lee.pdf
    • http://loaminoo.linkpc.net/1098097094091/Betty-Friedan-and-the-Making-of-quot-The-Feminine-Mystique-quot-The-American-Left-the-Cold-War-and-Modern-Feminism-by-Daniel-Horowitz.pdf
    • http://loaminoo.linkpc.net/1090094090095094094/Vergleich-Der-Darstellung-Des-quot-Wunderbaren-quot-in-Johann-Hartliebs-quot-Alexanderroman-quot-Und-Gottfried-Von-Straburgs-quot-Tristan-quot-by-Katharina-Neuhaus.pdf
    • http://loaminoo.linkpc.net/8097096094092096/Zauberherz-und-Liebeswunder-Drei-Romane-in-einem-eBook-quot-Body-Switch-quot-quot-Hungry-for-Love-quot-und-quot-Von-M-usen-und-Million-ren-quot-by-Ashley-Bloom.pdf
    • http://loaminoo.linkpc.net/2098098092095097/The-Third-Inspector-Morse-Omnibus-quot-Last-Bus-to-Woodstock-quot-quot-Wench-Is-Dead-quot-quot-Jewel-That-Was-Ours-quot-by-Colin-Dexter.pdf
    • http://loaminoo.linkpc.net/1091092098090097097/Philosophische-Elemente-im-Werk-von-Max-Frisch-Grundph-nomene-menschlicher-Existenz-in-den-Romanen-quot-Stiller-quot-quot-Homo-faber-quot-und-quot-Mein-Name-sei-Gantenbein-quot-by-Frauke-Maria-Ho-.pdf
    • http://loaminoo.linkpc.net/1093095097090094/Imbibe-From-Absinthe-Cocktail-to-Whiskey-Smash-a-Salute-in-Stories-and-Drinks-to-quot-Professor-quot-Jerry-Thomas-Pioneer-of-the-American-Bar-by-David-Wondrich.pdf
    • http://loaminoo.linkpc.net/1091096094095093097/Der-Ausflug-Ins-Innere-Der-Eigenen-Personlichkeit-Zur-Funktion-Der-Zitate-Im-Werk-Arno-Schmidts-Am-Beispiel-Von-quot-Brand-s-Haide-quot-quot-Kaff-Auch-Mare-Crisium-quot-Und-quot-Zettel-s-Traum-quot-by-Wolfgang-Hink.pdf
    • http://loaminoo.linkpc.net/1091096094095093098/Utopische-Prosa-ALS-L-Ngeres-Gedankenspiel-Untersuchungen-Zu-Arno-Schmidts-Theorie-Der-Modernen-Literatur-Und-Ihrer-Konkretisierung-in-quot-Schwarze-Spiegel-quot-quot-die-Gelehrtenrepublik-quot-Und-quot-Kaff-Auch-Mare-Crisium-quot-by-Boy-Hinrichs.pdf
    • http://loaminoo.linkpc.net/2098097097097093/Ruth-Rendell-Omnibus-II-quot-From-Doon-with-Death-quot-quot-Some-Lie-and-Some-Die-quot-quot-Shake-Hands-for-Ever-quot-quot-A-Sleeping-Life-quot-by-Ruth-Rendell.pdf
    • http://loaminoo.linkpc.net/60900950920950

Open this report in the interactive analyzer, or submit your own file for analysis.