Malicious PDF — malware analysis report

Static analysis result for SHA-256 3567219fda5fca6a…

MALICIOUS

PDF

12.9 KB Created: 2019-05-02 05:26:47 +01:00 Authoring application: mPDF 5.7
MD5: 7aec56ff1c81609ffb2a9f2205534e34 SHA-1: 238c311338a5bc4faef9a1e1ca0368118d3c63a7 SHA-256: 3567219fda5fca6a16b535e39a5dc86d211096d71bb8f89ce471331975bee2ee
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified as a PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles hosted on the loaminoo.linkpc.net domain. While the URLs themselves are marked as benign, the sheer volume and structure suggest a potential attempt to manipulate search engine results or to serve as a distribution point for malicious content. No scripts were extracted, and the document body primarily consists of these links.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8094099091090/Hiding-from-the-Light-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/3093093092096095/Hiding-from-the-Light-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/3092092090093092/Distant-Voices-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/4096091096093097/Sleeper-s-Castle-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/8094090094099/Daughters-of-Fire-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/1091091095092094/River-of-Destiny-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/8095091098096/Child-of-the-Phoenix-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/3093093095096095/Midnight-is-a-Lonely-Place-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/3092091091098090/Midnight-is-a-Lonely-Place-and-House-of-Echoes-by-Barbara-Erskine.pdf
    • http://loaminoo.linkpc.net/4099091094092090/The-Outrageous-Lady-by-Barbara-Cartland.pdf
    • http://loaminoo.linkpc.net/4097091098093099/Never-A-Lady-by-Barbara-Dawson-Smith.pdf
    • http://loaminoo.linkpc.net/3092097093091097/My-Lady-The-Spy-Brethren-of-the-Coast-2-by-Barbara-Devlin.pdf
    • http://loaminoo.linkpc.net/1091090096096/Lady-Luck-s-Map-of-Vegas-by-Barbara-O-39-Neal.pdf
    • http://loaminoo.linkpc.net/1091096090097099092/Lady-Nada-Botschaften-der-Liebe-by-Barbara-V-disch.pdf
    • http://loaminoo.linkpc.net/4096096094090097/Lady-of-the-Flames-A-Most-Peculiar-Season-3-by-Barbara-Monajem.pdf
    • http://loaminoo.linkpc.net/3099098096099095/The-Lady-of-the-Linden-Tree-by-Barbara-Leonie-Picard.pdf
    • http://loaminoo.linkpc.net/1099091097096094/The-Brotherhood-by-Y-A-Erskine.pdf
    • http://loaminoo.linkpc.net/4091099096097/God-s-Little-Acre-by-Erskine-Caldwell.pdf
    • http://loaminoo.linkpc.net/1090096091092/Mockingbird-by-Kathryn-Erskine.pdf
    • http://loaminoo.linkpc.net/4094096094099093/Mockingbird-by-Kathryn-Erskine.pdf
    • http://loaminoo.linkpc.net/4096096094090097/

Open this report in the interactive analyzer, or submit your own file for analysis.