PDF malware analysis — malicious · fd3eca32c9c108e6

MALICIOUS

PDF

18.8 KB Created: 2019-05-02 07:03:17 +01:00 Authoring application: mPDF 5.7

MD5: 028cec468d487a0f5a422c9871dc67da SHA-1: 0588f7be6b53366a997cde73983b55b5c4f6110f SHA-256: fd3eca32c9c108e69541aef7754cc66c9f9e41018074b2f3447f72fbe8d90386

90 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to a dynamic DNS domain, indicating a link farm or SEO poisoning attempt. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the heuristic 'PDF_SEO_LINK_FARM' strongly suggests the document's purpose is to redirect users to potentially malicious content hosted on 'loaminoo.linkpc.net'.

Machine Learning

Nyx PDF Classifier malicious score 0.9920

Heuristics 2

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://loaminoo.linkpc.net/8097095095090098/Das-Lied-der-Natur-Romantische-Fantasien-by-H-l-ne-Grimaud.pdf
- http://loaminoo.linkpc.net/1090091092097093098/Schmutzige-Fantasien-2-by-Gina-Joy.pdf
- http://loaminoo.linkpc.net/4099097090090091/Wild-Harmonies-A-Life-of-Music-and-Wolves-by-H-l-ne-Grimaud.pdf
- http://loaminoo.linkpc.net/6093097091098097/Sexuelle-Fantasien-Sex-Stories-by-Gerold-Ebner.pdf
- http://loaminoo.linkpc.net/8097095094092094/Universite-de-Paris-Faculte-de-Droit-de-La-Capacite-Des-Enfants-Naturels-a-Recevoir-Par-Donations-These-Pour-Le-Doctorat-by-Grimaud.pdf
- http://loaminoo.linkpc.net/1091095097095092095/Schmutzige-Fantasien-19---Swinger-Gruppensex-Sexgeschichten-ein-flotter-Dreier-ein-Vierer-sogar-ein-F-nfer-by-Gina-Joy.pdf
- http://loaminoo.linkpc.net/2096091095093095/Hello-I-Lied-by-M-E-Kerr.pdf
- http://loaminoo.linkpc.net/3090091096092093/Hello-I-Lied-by-M-E-Kerr.pdf
- http://loaminoo.linkpc.net/7091095092095/What-I-Saw-and-How-I-Lied-by-Judy-Blundell.pdf
- http://loaminoo.linkpc.net/9093094091094093/Heinrich-Heine-and-the-Lied-by-Susan-Youens.pdf
- http://loaminoo.linkpc.net/1090090092098098095/Der-romantische-dipus-Ein-Lustspiel-in-5-Akten-by-August-von-Platen.pdf
- http://loaminoo.linkpc.net/1091092098096095097/Ungeliebter-Million-r---Romantische-Liebesgeschichte-by-Bettina-K-nig.pdf
- http://loaminoo.linkpc.net/3090094096097096/Game-of-Thrones---Das-Lied-von-Eis-und-Feuer-6-by-George-R-R-Martin.pdf
- http://loaminoo.linkpc.net/5095090095096091/Das-Lied-der-Kr-hen-Glory-or-Grave-1-by-Leigh-Bardugo.pdf
- http://loaminoo.linkpc.net/1090099097094099097/Das-Lied-der-Novizin-Historischer-Roman-by-Sarah-Dunant.pdf
- http://loaminoo.linkpc.net/1090093096096099091/Im-Zeichen-des-Fuchses-Ein-Lied-der-Magie-1-by-Felix-K-fer.pdf
- http://loaminoo.linkpc.net/7098091092091090/You-Can-Read-Anyone-Never-Be-Fooled-Lied-To-or-Taken-Advantage-of-Again-by-David-J-Lieberman.pdf
- http://loaminoo.linkpc.net/8099093092099091/Romantische-Bibliothek---Folge-9-Sie-fanden-ein-neues-Zuhause-by-Paula-Mai.pdf
- http://loaminoo.linkpc.net/1090091091090094097/Das-Lied-von-den-Riesen-Mit-Zeichnungen-von-Lorenz-Helfer-by-Michael-K-hlmeier.pdf
- http://loaminoo.linkpc.net/7098091092094097/Never-Be-Lied-to-Again-How-to-Get-the-Truth-in-5-Minutes-or-Less-in-Any-Conversation-or-Situation-by-David-J-Lieberman.pdf
- http://loaminoo.linkpc.net/1091095097095092095/Schmutzige-Fantasien-19---Swinger-Gruppensex-Sexgeschichten-ein-flotter-Dreier-ein-Vierer-sogar-

Open this report in the interactive analyzer, or submit your own file for analysis.