Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c6213378add6dc1…

MALICIOUS

PDF

18.7 KB Created: 2019-05-01 11:13:53 +01:00 Authoring application: mPDF 5.7
MD5: 5272acd5d85b3002686d6f9a2273cf7f SHA-1: 32184f375227e401781ce83c1047a3ebaf0c4853 SHA-256: 3c6213378add6dc124791f54eeafd30563a8aa2a92dabf7f1c73b82a151de33b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, hosted on a dynamic DNS domain. This suggests a link farm or redirection tactic to distribute further malicious content. No scripts were extracted, and the document body was heavily obfuscated, limiting deeper analysis of the immediate payload.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8098093094096093/Ricarda-Huch-1864-1947-Einfuhrung-in-Ihr-Leben-Und-Werk-Jubilaumsband-Zu-Ihrem-50-Todestag-Anlasslich-Des-Internationalen-Ricarda-Huch-Fors-by-Hans-Werner-Peter.pdf
    • http://loaminoo.linkpc.net/1091092093091095090/Du-Mein-Damon-Meine-Schlange---Briefe-an-Richard-Huch-1887-1897-by-Ricarda-Huch.pdf
    • http://loaminoo.linkpc.net/8098093094095099/Der-gro-e-Krieg-in-Deutschand-by-Ricarda-Huch.pdf
    • http://loaminoo.linkpc.net/1091092093091095092/Der-Gro-e-Krieg-in-Deutschland-Vol-3-Der-Zusammenbruch-1633-1650-by-Ricarda-Huch.pdf
    • http://loaminoo.linkpc.net/8098093094095095/The-Trauma-Of-Defeat-Ricarda-Huch-s-Historiography-During-The-Weimar-Republic-by-James-M-Skidmore.pdf
    • http://loaminoo.linkpc.net/8098093095095092/Kanada---Das-Chaos-schl-gt-wieder-zu-by-Ricarda-Peter.pdf
    • http://loaminoo.linkpc.net/8098093093093096/Bound-by-Ricarda-Tomlin.pdf
    • http://loaminoo.linkpc.net/9090092098094096/Der-fliegende-Holl-nder-by-Friedrich-Huch.pdf
    • http://loaminoo.linkpc.net/1091092093091095097/10-Curses-That-Block-The-Blessing-CD-6-CD-by-Larry-Huch.pdf
    • http://loaminoo.linkpc.net/1091092093091096090/Einfa1-4hrung-in-Die-Kostenrechnung-by-Burkhard-Huch.pdf
    • http://loaminoo.linkpc.net/1091092092098097097/Releasing-Family-Blessings-God-s-Plan-for-Your-Marriage-and-Children-by-Larry-Huch.pdf
    • http://loaminoo.linkpc.net/1090092092096092097/Der-Anu-Adad-Tempel-in-Assur-by-Hans-Peter-Werner.pdf
    • http://loaminoo.linkpc.net/1091090098095097093/Einf-hrung-in-das-Werk-Walthers-von-der-Vogelweide-by-Otfrid-Ehrismann.pdf
    • http://loaminoo.linkpc.net/1091090098095093092/Einf-hrung-in-das-Werk-Thomas-Manns-by-Julia-Sch-ll.pdf
    • http://loaminoo.linkpc.net/9097098097090091/Einf-hrung-in-das-Werk-Walthers-von-der-Vogelweide-by-Otfrid-Ehrismann.pdf
    • http://loaminoo.linkpc.net/1090097091096093095/Einf-hrung-in-die-Mechatronik-by-Werner-Roddeck.pdf
    • http://loaminoo.linkpc.net/9096092096091091/Hans-Fallada-s-Crisis-Novels-1931---1947-by-Geoff-Wilkes.pdf
    • http://loaminoo.linkpc.net/1090090093098093098/Einf-hrung-in-Machiavellis-Werk-Der-F-rst-Die-Fibel-f-r-Tyrannen-oder-diejenige-die-einer-werden-wollen-by-Joel-Eiglmeier.pdf
    • http://loaminoo.linkpc.net/9095094098092092/Morton-Rhue-Leben-und-Werk-by-Nicola-Bardola.pdf
    • http://loaminoo.linkpc.net/1091091099094092090/Irmgard-Keun-Leben-Und-Werk-by-Ingrid-Marchlewitz.pdf