Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d80e8f821199b11…

MALICIOUS

PDF

17.2 KB Created: 2019-05-06 16:58:11 +01:00 Authoring application: mPDF 5.7
MD5: 542bcd668472450233039bb9b372031e SHA-1: 19933b29284730cfb41505985b3c33ac06800dea SHA-256: 2d80e8f821199b11e5687762d038047032619a14fbada6d0bc192c9d30483b7b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. While most of these links point to benign content, the sheer volume and the nature of the heuristic suggest a potential attempt at SEO manipulation or distributing malicious payloads. No scripts were extracted, and the document body was unreadable, limiting further analysis of the specific intent.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091091092099092/Moon-Bear-by-Gill-Lewis.pdf
    • http://loaminoo.linkpc.net/5091091095094092/Hawk-Mother-The-Story-of-a-Red-Tailed-Hawk-Who-Hatched-Chickens-by-Kara-Hagedorn.pdf
    • http://loaminoo.linkpc.net/4099090096091096/Jesse-Hawk-Brave-Father-Hawk-Brothers-2-by-Sheri-Whitefeather.pdf
    • http://loaminoo.linkpc.net/3097091092093098/One-Sixth-of-a-Gill-by-Jean-Gill.pdf
    • http://loaminoo.linkpc.net/1097092091095099/The-White-Hawk-Redemption-The-White-Hawk-4-by-David-Pilling.pdf
    • http://loaminoo.linkpc.net/8092095098095091/The-Journals-of-Lewis-amp-Clark-1804-1806-Meriwether-Lewis-1774-1809-amp-William-Clark-1770-1838-by-Meriwether-Lewis.pdf
    • http://loaminoo.linkpc.net/4097094094098098/A-Doll-s-Story-The-fall-and-rise-of-Merr-StahlRhune-by-Lez-Lewis-by-Lez-Lewis.pdf
    • http://loaminoo.linkpc.net/2099093090099096/Novels-by-C-S-Lewis-The-Screwtape-Letters-the-Great-Divorce-Out-of-the-Silent-Planet-Till-We-Have-Faces-the-Pilgrim-s-Regress-by-C-S-Lewis.pdf
    • http://loaminoo.linkpc.net/2096099097090095/C-S-Lewis-Essay-Collection-amp-Other-Short-Pieces-by-C-S-Lewis.pdf
    • http://loaminoo.linkpc.net/9090098091094092/Prince-Caspian-the-Chronicles-of-Narnia---C-S-Lewis-by-C-S-Lewis.pdf
    • http://loaminoo.linkpc.net/3096091092093090/The-Visionary-Christian-131-Readings-from-C-S-Lewis-by-C-S-Lewis.pdf
    • http://loaminoo.linkpc.net/5094091096095095/AA-Gill-is-Away-by-A-A-Gill.pdf
    • http://loaminoo.linkpc.net/4090097092093097/I-Vampire-by-Carole-Gill.pdf
    • http://loaminoo.linkpc.net/2090097090094095/All-That-We-Remember-by-Elenor-Gill.pdf
    • http://loaminoo.linkpc.net/3091090093092096/To-Sin-with-Scandal-by-Tamara-Gill.pdf
    • http://loaminoo.linkpc.net/6096098092098095/Lewis-Carroll-Box-Set-Alice-Adventures-in-Wonderland-and-Through-the-Looking-Glass-Including-the-Short-Film-the-Delivery-by-Lewis-Carroll.pdf
    • http://loaminoo.linkpc.net/4099090092091095/City-of-the-Horizon-by-Anton-Gill.pdf
    • http://loaminoo.linkpc.net/1095098099091090/Underlife-by-January-Gill-O-39-Neil.pdf
    • http://loaminoo.linkpc.net/5094091098093093/The-Gorillas-of-Gill-Park-by-Amy-Gordon.pdf
    • http://loaminoo.linkpc.net/3099099093094095/Plaint-for-Provence-by-Jean-Gill.pdf
    • http://loaminoo.linkpc.net/2

Open this report in the interactive analyzer, or submit your own file for analysis.