Malicious PDF — malware analysis report

Static analysis result for SHA-256 39a0816de8bbe015…

MALICIOUS

PDF

19.7 KB Created: 2019-05-05 15:58:50 +01:00 Authoring application: mPDF 5.7
MD5: 5f9e9246d4603280b8e5dff32686b5b2 SHA-1: 72383ed7f809601c4eca2f34d943fa9bcb088e43 SHA-256: 39a0816de8bbe01530742d6c0305ddcdb95a56696a71b2d88511b44198cdacd1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was identified as malicious due to a critical heuristic firing for a large number of external PDF links. These links, such as http://loaminoo.linkpc.net/9090091099092095/Wenn-Christus-in-Dir-erwacht-by-Richard-Adelbrand.pdf, likely serve as a link farm to distribute further malicious content or phish users. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9090091099092095/Wenn-Christus-in-Dir-erwacht-by-Richard-Adelbrand.pdf
    • http://loaminoo.linkpc.net/9090091097094094/G-nsehaut---Um-Mitternacht-wenn-die-Vogelscheuche-erwacht-Die-G-nsehaut-Reihe-6-by-R-L-Stine.pdf
    • http://loaminoo.linkpc.net/9090091099093095/PHOENIX-Durch-dich-erwacht-PHOENIX---durch-dich-erwacht-1-by-Saraphina-J-C-Rose.pdf
    • http://loaminoo.linkpc.net/1091090091090090091/Sicher-anlegen-Was-Sie-wissen-sollten-wenn-Sie-Geld-investieren-Was-tun-wenn-etwas-schief-l-uft-Ausgabe-sterreich-by-Angelika-Ahrens.pdf
    • http://loaminoo.linkpc.net/1091091092094099096/No-Vazio-Do-Mundo-Mira-Schendel-by-Mira-Schendel.pdf
    • http://loaminoo.linkpc.net/9090092090098094/Troubletwisters---Das-B-se-erwacht-Band-2---by-Garth-Nix.pdf
    • http://loaminoo.linkpc.net/9091098094094095/Joseph-Roth---Gesammelte-Werke-Romane-Erz-hlungen-Journalistische-Schriften-mehr-als-30-Titel-in-einem-E-Book---Radetzkymarsch-Hiob-Die-Kapuzinergruft-Trinker-Das-falsche-Gewic-by-Joseph-Roth.pdf
    • http://loaminoo.linkpc.net/6099094099094098/Philip-Roth-Reads-from-His-Zuckerman-Bound-by-Philip-Roth.pdf
    • http://loaminoo.linkpc.net/1091092097098091/The-World-of-Veronica-Roth-s-Divergent-Series-by-Veronica-Roth.pdf
    • http://loaminoo.linkpc.net/1091097093092099091/Die-Savanne-erwacht---Die-gewaltige-Flora-und-Fauna-Afrikas-Bewegungen-der-W-ste-festgehalten-ein-Faszinierender-Bildband-by-Lorenz-Andreas-Fischer.pdf
    • http://loaminoo.linkpc.net/8090097090092097/A-Philip-Roth-Reader-by-Philip-Roth.pdf
    • http://loaminoo.linkpc.net/2090093091096094/The-S-Before-Ex-by-Mira-Lyn-Kelly.pdf
    • http://loaminoo.linkpc.net/1090092099093095096/Magick-by-Mira-Monroe.pdf
    • http://loaminoo.linkpc.net/2096092092091098/Final-Girls-by-Mira-Grant.pdf
    • http://loaminoo.linkpc.net/1090092099091092097/The-Chronicles-of-the-Mira-by-Christine-E-Schulze.pdf
    • http://loaminoo.linkpc.net/5090092095092091/Apocalypse-Scenario-683-The-Box-by-Mira-Grant.pdf
    • http://loaminoo.linkpc.net/3094091096095096/Now-and-Then-Dare-to-Love-3-by-Mira-Lyn-Kelly.pdf
    • http://loaminoo.linkpc.net/1096097096097096/Yoga-The-Iyengar-Way-by-Mira-Silva.pdf
    • http://loaminoo.linkpc.net/3094092099093097/Mira-Corpora-by-Jeff-Jackson.pdf
    • http://loaminoo.linkpc.net/2091092091095/The-Memory-Palace-by-Mira-Bartok.pdf
    • http://loaminoo.linkpc.net/9090092090098094/Troubletwisters---Das-B-se-er

Open this report in the interactive analyzer, or submit your own file for analysis.