Malicious PDF — malware analysis report

Static analysis result for SHA-256 25f908852b31280d…

MALICIOUS

PDF

18.7 KB Created: 2019-05-02 03:14:55 +01:00 Authoring application: mPDF 5.7
MD5: 505e6c5c662a828f08fab7592f317cde SHA-1: 60ebdca002a8f2c0c84bc3448e4bfda7ff2eaafb SHA-256: 25f908852b31280d37928f7af371537716ee419d32dc81a1efff268019776a8b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF documents hosted on loaminoo.linkpc.net. While the URLs themselves are currently marked as benign, the sheer volume and nature of the links suggest a malicious intent, possibly for SEO spam or to distribute further malicious content. No scripts were extracted, and the document body was heavily corrupted, limiting further analysis.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091096095092095097/Der-standhafte-Prinz-by-Pedro-Calder-n-de-la-Barca.pdf
    • http://loaminoo.linkpc.net/1095098097091095/Life-Is-a-Dream-by-Pedro-Calder-n-de-la-Barca.pdf
    • http://loaminoo.linkpc.net/1091099093099092098/Das-Leben-Ein-Traum-Dramatisches-gedicht-in-5-akten-by-Pedro-Calder-n-de-la-Barca.pdf
    • http://loaminoo.linkpc.net/1090096098096090099/Life-Is-a-Dream-and-Other-Spanish-Classics-Eric-Bentley-s-Dramatic-Repertoire---Volume-II-by-Pedro-Calder-n-de-la-Barca.pdf
    • http://loaminoo.linkpc.net/1090096098095090094/Calderon-Plays-1-The-Surgeon-of-Honour-Life-is-a-Dream-Three-Judgements-in-One-by-Pedro-Calder-n-de-la-Barca.pdf
    • http://loaminoo.linkpc.net/1090096098095095096/Continental-Drama-Calder-n-Corneille-Racine-Moli-re-Lessing-Schiller-by-Pedro-Calder-n-de-la-Barca.pdf
    • http://loaminoo.linkpc.net/6091098095090095/Chefs-d-Oeuvre-des-Th-tres-trangers---Treizi-me-Livraison---Th-tre-Espagnol--Tome-II---Calder-n-by-Pedro-Calder-n-de-la-Barca.pdf
    • http://loaminoo.linkpc.net/1090096098096091097/Select-plays-of-Calder-n-by-Pedro-Calder-n-de-la-Barca.pdf
    • http://loaminoo.linkpc.net/1099091094096090/This-Calder-Range-Calder-Saga-1-by-Janet-Dailey.pdf
    • http://loaminoo.linkpc.net/1091096095091096098/Der-standhafte-Papagei---Erinnerungen-an-Teheran-1979-by-Amir-Hassan-Cheheltan.pdf
    • http://loaminoo.linkpc.net/4091094091094/Becoming-Calder-by-Mia-Sheridan.pdf
    • http://loaminoo.linkpc.net/2097096093092090/The-Dragonslayer-s-Apprentice-by-David-Calder.pdf
    • http://loaminoo.linkpc.net/3090094096099098/Calder-Tales-of-the-Shareem-4-by-Allyson-James.pdf
    • http://loaminoo.linkpc.net/3090094092094093/Timescale-An-Atlas-of-the-Fourth-Dimension-by-Nigel-Calder.pdf
    • http://loaminoo.linkpc.net/2093098099096092/The-Untold-Story-My-20-Years-Running-the-National-Inquirer-by-Iain-Calder.pdf
    • http://loaminoo.linkpc.net/9097093090099094/Hypatia-Essays-In-Classics-Comparative-Literature-And-Philosophy-by-William-M-Calder.pdf
    • http://loaminoo.linkpc.net/1091097096092090096/Eduard-Meyer-Leben-Und-Leistung-Eines-Universalhistorikers-by-William-M-Calder.pdf
    • http://loaminoo.linkpc.net/3097090095093090/If-You-re-Lucky-by-Yvonne-Prinz.pdf
    • http://loaminoo.linkpc.net/9092090099099097/Still-There-Clare-by-Yvonne-Prinz.pdf
    • http://loaminoo.linkpc.net/6095091094099094/Prinz-Heinrich-Von-Preussen-by-Eva-Ziebura.pdf
    • http://loaminoo.linkpc.net/60910980950900

Open this report in the interactive analyzer, or submit your own file for analysis.