Malicious PDF — malware analysis report

Static analysis result for SHA-256 35e34c0e00fb2104…

MALICIOUS

PDF

15.7 KB Created: 2019-05-07 04:51:01 +01:00 Authoring application: mPDF 5.7
MD5: 73186dc6536b3cbc009b0d0892adf958 SHA-1: 74838683d7a73cb3c2754aee5e9a7d5051226bc6 SHA-256: 35e34c0e00fb2104a52c8bbc32166f208a428ce5332a16cd68fb6652cc53b12f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs pointing to external PDF documents, identified as a PDF SEO link farm. While the document body is heavily obfuscated, the presence of numerous links suggests an attempt to manipulate search engine results or redirect users to potentially malicious content. No scripts were extracted from this sample. The primary IOCs are the URLs found within the document.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4099094097/Any-Time-Any-Place-Billionaire-Builders-2-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/6094093099096/The-Book-of-Spells-Marriage-to-a-Billionaire-3-5-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/4097094097098/The-Marriage-Merger-Marriage-to-a-Billionaire-4-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/2096097099097092/Sex-Lies-and-Contracts-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/2092099092099090/The-Tantric-Principle-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/2096094090092092/Beyond-Me-Quinn-and-James-1-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/2092092098097096/The-Holiday-Hoax-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/1091095097091095097/Searching-for-Love-Verlockung-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/4097091092095092/Summer-Sins-Hot-in-the-Hamptons-3-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/3094095099091099/Chasing-Me-Quinn-and-James-2-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/8092095090/The-Start-of-Something-Good-Stay-1-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/1090097097091099098/Playing-with-Fire---Feurige-Versuchung-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/8098094091096095/Playing-with-Fire---Sinnliche-Ber-hrung-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/2098095098092097/Catch-Me-Steele-Brothers-1-1Night-Stand-89-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/2098095097095091/Dare-Me-Steele-Brothers-3-1Night-Stand-111-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/2098095098092094/Play-Me-Steele-Brothers-2-1Night-Stand-98-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/2095091099091090/Lexie-s-First-Time-Borrowed-Billionaire-0-5-Billionaire-Novelist-0-5-by-Mimi-Strong.pdf
    • http://loaminoo.linkpc.net/1091093094097/Searching-for-Mine-Searching-For-4-5-1001-Dark-Nights-35-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/4091097093092/Searching-for-Perfect-Searching-For-2-by-Jennifer-Probst.pdf
    • http://loaminoo.linkpc.net/1091095091092092099/The-Lipstick-Mystic-s-Guide-to-Time-Traveling-Healing-the-Time-Body-and-Finding-the-Best-Possible-Timeline-by-Jennifer-Shepherd.pdf
    • http://loaminoo.linkpc.net/1090097097091099098/Playing-with-Fire---Feuri

Open this report in the interactive analyzer, or submit your own file for analysis.