Malicious PDF — malware analysis report

Static analysis result for SHA-256 2492a4854f4c97a3…

MALICIOUS

PDF

18.1 KB Created: 2019-04-30 18:45:32 +01:00 Authoring application: mPDF 5.7
MD5: 3fe70f888bddba2147e0cde4dbc43f67 SHA-1: 2eb03f392b072369475c7189a7513a6f2799e1f4 SHA-256: 2492a4854f4c97a3bd985a5b4798206497aecb82a5513937bcde97f615d95209
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing indicating a link farm, with numerous embedded URLs pointing to external PDF documents. The document body is heavily obfuscated and unreadable, preventing a clear determination of its specific lure. However, the sheer volume of links suggests an attempt to manipulate search engine results or distribute content from the 'loaminoo.linkpc.net' domain. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3096096099090095/Psmith-Journalist-Psmith-3-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/6099097098090/Psmith-in-the-City-Psmith-2-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/1091092094091093/Mike-and-Psmith-Psmith-1-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/1099093090094097/Mike-and-Psmith-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/1092094097098090/Leave-It-to-Psmith-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/4092090094097091/Mike-Psmith-1-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/1090091096099098098/Buck-Godot-Psmith-Buck-Godot-2-by-Phil-Foglio.pdf
    • http://loaminoo.linkpc.net/3097096093090099/Week-End-Wodehouse-by-P-G-Wodehouse.pdf
    • http://loaminoo.linkpc.net/2093099093094095/Working-As-A-Journalist-by-John-Brophy.pdf
    • http://loaminoo.linkpc.net/2094092093091099/DMZ-Vol-2-Body-of-a-Journalist-by-Brian-Wood.pdf
    • http://loaminoo.linkpc.net/4095092094092/News-to-Me-Adventures-of-an-Accidental-Journalist-by-Laurie-Hertzel.pdf
    • http://loaminoo.linkpc.net/1095094094095094/Unsanctioned-Voice-Garet-Garrett-Journalist-of-the-Old-Right-by-Bruce-Ramsey.pdf
    • http://loaminoo.linkpc.net/9092093095099/The-Case-for-a-Creator-A-Journalist-Investigates-Scientific-Evidence-That-Points-Toward-God-by-Lee-Strobel.pdf
    • http://loaminoo.linkpc.net/1090091095095090/The-Case-for-Grace-A-Journalist-Explores-the-Evidence-of-Transformed-Lives-by-Lee-Strobel.pdf
    • http://loaminoo.linkpc.net/3098099098099/The-Case-for-Faith-A-Journalist-Investigates-the-Toughest-Objections-to-Christianity-by-Lee-Strobel.pdf
    • http://loaminoo.linkpc.net/4092092093090099/Reporting-from-Ramallah-An-Israeli-Journalist-in-an-Occupied-Land-by-Amira-Hass.pdf
    • http://loaminoo.linkpc.net/6099099097098094/The-Case-for-Christ-A-Journalist-s-Personal-Investigation-of-the-Evidence-for-Jesus-by-Lee-Strobel.pdf
    • http://loaminoo.linkpc.net/6096094098097090/Bali-Nusa-Penida-amp-Lombok-A-journalist-s-travelogue-by-James-Hyams.pdf
    • http://loaminoo.linkpc.net/1090096090099099091/The-Rediscovered-Writings-of-Rose-Wilder-Lane-Literary-Journalist-by-Amy-Mattson-Lauters.pdf
    • http://loaminoo.linkpc.net/2093091097092095/The-Woman-Who-Fell-from-the-Sky-An-American-Journalist-s-Adventures-in-the-Oldest-City-on-Earth-by-Jennifer-Steil.pdf
    • http://loaminoo.linkpc.net/9092093095099/The-Case-for-a-Creator-A-Journalist-Investigates-S

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off000001c6.bin
d16bfdb6bcce16a66d4580c801570715587150694943411857f80e1417eef623
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1C6 9410 bytes