Malicious PDF — malware analysis report

Static analysis result for SHA-256 35b1b34b345a8022…

MALICIOUS

PDF

20.7 KB Created: 2019-04-30 01:59:49 +01:00 Authoring application: mPDF 5.7
MD5: 48d5ab3d8d575ae037f1de3aa3a574bd SHA-1: 8f76a7c0614ceb3e25bed666c3c80658e073ce43 SHA-256: 35b1b34b345a8022a94a8d272005a31a90923ebb3d25baf89df145d1f9b7e9bf
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on the loaminoo.linkpc.net domain, suggesting a link farm or SEO poisoning tactic. The embedded URLs within the document body confirm this behavior. The primary goal appears to be directing users to these external resources, potentially for malicious distribution or phishing.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8092097097099095/Alibaba-and-Forty-Thieves-Story-of-Treasure-by-Scheherazade.pdf
    • http://loaminoo.linkpc.net/9097093097094093/Alibaba-amp-The-Forty-Thieves-by-Pegasus.pdf
    • http://loaminoo.linkpc.net/4096093092099095/The-Tale-of-Ali-Baba-and-the-Forty-Thieves-A-Story-from-the-Arabian-Nights-by-Anonymous.pdf
    • http://loaminoo.linkpc.net/1095098093096099/Forty-Thieves-by-Thomas-Perry.pdf
    • http://loaminoo.linkpc.net/1099096093097093/Ali-Baba-and-the-Forty-Thieves-Arabian-Nights-Adventures-4-by-Harpendore.pdf
    • http://loaminoo.linkpc.net/3097092093096094/Tower-of-Treasure-Three-Thieves-1-by-Scott-Chantler.pdf
    • http://loaminoo.linkpc.net/4091099090098/The-Monuments-Men-Allied-Heroes-Nazi-Thieves-and-the-Greatest-Treasure-Hunt-in-History-by-Robert-M-Edsel.pdf
    • http://loaminoo.linkpc.net/8092097098096099/Scheherazade-Cat---The-Story-of-a-War-Hero-by-Stephanie-C-Fox.pdf
    • http://loaminoo.linkpc.net/1096097099095098/The-Girls-from-Ames-A-Story-of-Women-and-a-Forty-Year-Friendship-by-Jeffrey-Zaslow.pdf
    • http://loaminoo.linkpc.net/5092099097094/Forty-Autumns-A-Family-s-Story-of-Courage-and-Survival-on-Both-Sides-of-the-Berlin-Wall-by-Nina-Willner.pdf
    • http://loaminoo.linkpc.net/4090091095094/Double-Crossed-A-Spies-and-Thieves-Story-Gallagher-Girls-5-5-Heist-Society-2-5-by-Ally-Carter.pdf
    • http://loaminoo.linkpc.net/4094099098096095/Girls-Like-Us-Forty-Extraordinary-Women-Celebrate-Girlhood-in-Story-Poetry-and-Song-by-Gina-Ren-e-Misiroglu.pdf
    • http://loaminoo.linkpc.net/5096099093092099/Treasure-Island-A-Story-of-the-Spanish-Main-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/9094092099/The-Curse-of-Oak-Island-The-Story-of-the-World-s-Longest-Treasure-Hunt-by-Randall-Sullivan.pdf
    • http://loaminoo.linkpc.net/6092099099090096/Alibaba-40-Dongala-Adbuta-Khadalu-by-saili.pdf
    • http://loaminoo.linkpc.net/4092092092091093/Treasure-of-Egypt-Humorous-Mystery-Book-1---Treasure-of-the-Ancients-by-Barbara-Ivie-Green.pdf
    • http://loaminoo.linkpc.net/4090091096095094/The-Story-of-the-Treasure-Seekers-by-Edith-Nesbit-Fiction-Family-Siblings-Fantasy-amp-Magic-by-E-Nesbit.pdf
    • http://loaminoo.linkpc.net/1090095096097091095/Por-Dentro-do-Alibaba-Como-a-Maior-Empresa-de-e-Commerce-do-Mundo-Est-Mudando-os-Rumos-dos-Neg-cios-On-line-by-Porter-Erisman.pdf
    • http://loaminoo.linkpc.net/2097093091097091/Rules-for-Thieves-Rules-for-Thieves-1-by-Alexandra-Ott.pdf
    • http://loaminoo.linkpc.net/8092097097099090/Scheherazade-by-Serena-Mint.pdf
    • http://loaminoo.linkpc.net/5092099

Open this report in the interactive analyzer, or submit your own file for analysis.