Malicious PDF — malware analysis report

Static analysis result for SHA-256 feee4c554776da5e…

MALICIOUS

PDF

17.2 KB Created: 2019-05-02 17:40:20 +01:00 Authoring application: mPDF 5.7
MD5: b30cb499db234aa76ed90fc9294c8990 SHA-1: af33e6400d865fb91664d078b39d46272f55255e SHA-256: feee4c554776da5eb275150e101ecd0faa514adcc7f5b1c725e01331d914f978
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files hosted on the loaminoo.linkpc.net domain. This heuristic firing suggests a link farm or redirection tactic. The ML classifier also strongly indicated maliciousness. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the immediate user-facing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8098095098093090/The-woman-in-white---A-romantic-mysterious-story-Annotated-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/5095099098095090/The-Woman-in-White-Annotated-Novel-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/5098093096093095/The-Woman-in-White-Pilgrim-Classics-Annotated-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/9098095092096099/The-Woman-in-White-by-Wilkie-Collins---Delphi-Classics-Illustrated-Delphi-Parts-Edition-Wilkie-Collins-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/8095094093099090/The-Woman-in-White-In-One-Moment-Every-Drop-of-Blood-in-My-Body-Was-Brought-to-a-Stop-There-as-If-It-Had-That-Moment-Sprung-Out-of-the-Earth-Stood-the-Figure-of-a-Solitary-Woman-Dressed-from-Head-to-Foot-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/5097095092098096/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/9091090093094094/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/3092095091096/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/8094095097096096/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/9096096098093097/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/1090099092096092090/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/9096098094090092/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/8098099094090091/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/4091095097091091/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/6099099092092090/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/3094097098099096/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/4098090095093098/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/2095095093093094/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/7096092096091093/The-Woman-in-White-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/3098097095096092/The-Woman-in-White-ebook-by-Wilkie-Collins.pdf
    • http://loaminoo.linkpc.net/30920950910

Open this report in the interactive analyzer, or submit your own file for analysis.