Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c68a0bdddebb13b…

MALICIOUS

PDF

18.2 KB Created: 2019-04-30 02:51:04 +01:00 Authoring application: mPDF 5.7
MD5: ff8faee54dfc1491fc16d85b28becac3 SHA-1: 2b4890e8dcdc7a47125b7d350c4f272b6fea0e84 SHA-256: 3c68a0bdddebb13b89e0aa6f3e2f687b534402479ed9eaa225de98aa8675d4a3
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, forming a link farm. The heuristic PDF_SEO_LINK_FARM indicates this is a technique to artificially inflate search engine rankings or distribute malicious links. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent to redirect users. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1098099091097099/A-Single-Swallow-Following-An-Epic-Journey-From-South-Africa-To-South-Wales-by-Horatio-Clare.pdf
    • http://loaminoo.linkpc.net/6090095096098097/Rum-Rebellion-A-Study-Of-The-Overthrow-Of-Governor-Bligh-By-John-Macarthur-And-The-New-South-Wales-Corps-by-H-V-Evatt.pdf
    • http://loaminoo.linkpc.net/5090093090098094/Christmas-Every-Day-by-William-Dean-Howells.pdf
    • http://loaminoo.linkpc.net/4095097091092099/A-Traveler-from-Altruria-by-William-Dean-Howells.pdf
    • http://loaminoo.linkpc.net/7091097094096098/Stories-of-Ohio-by-William-Dean-Howells.pdf
    • http://loaminoo.linkpc.net/1098099098097099/Rees-Howells-Intercessor-by-Norman-P-Grubb.pdf
    • http://loaminoo.linkpc.net/1093092097093094/The-Landlord-at-Lion-s-Head-by-William-Dean-Howells.pdf
    • http://loaminoo.linkpc.net/1091096093091092/The-Rise-of-Silas-Lapham-by-William-Dean-Howells.pdf
    • http://loaminoo.linkpc.net/1091094092095092/When-the-Alps-Cast-Their-Spell-Mountaineers-of-the-Alpine-Golden-Age-by-Trevor-Braham.pdf
    • http://loaminoo.linkpc.net/1094092092094090/Children-of-Crisis-Volume-2-Migrants-Sharecroppers-Mountaineers-by-Robert-Coles.pdf
    • http://loaminoo.linkpc.net/2095094098094091/The-South-vs-The-South-How-Anti-Confederate-Southerners-Shaped-the-Course-of-the-Civil-War-by-William-W-Freehling.pdf
    • http://loaminoo.linkpc.net/1091094092097091/Cold-Feet-Stories-of-a-Middling-Climber-On-Classic-Peaks-amp-Among-Legendary-Mountaineers-by-David-Pagel.pdf
    • http://loaminoo.linkpc.net/4095091099090096/Guns-Drugs-and-Coconuts-South-Pacific-and-South-East-Asia-by-John-Frederick-Dixon.pdf
    • http://loaminoo.linkpc.net/1091098091090090093/Far-East-Down-South-Asians-in-the-American-South-by-Raymond-A-Mohl.pdf
    • http://loaminoo.linkpc.net/7097099097099092/Ignorant-Bliss-by-Brendan-Lee.pdf
    • http://loaminoo.linkpc.net/7097099097098099/Ignorant-Armies-by-Sam-Wharton.pdf
    • http://loaminoo.linkpc.net/7097099099090099/Stories-for-an-Ignorant-Man-by-Ina-Disguise.pdf
    • http://loaminoo.linkpc.net/7097099097097091/Ignorant-Armies-by-David-Pringle.pdf
    • http://loaminoo.linkpc.net/7097099097099091/Ignorant-Armies-by-Karen-Alkalay-Gut.pdf
    • http://loaminoo.linkpc.net/7097099099091098/You-re-Not-Stupid-You-re-Ignorant-by-Lance-Hodge.pdf
    • http://loaminoo.linkpc.net/10930920

Open this report in the interactive analyzer, or submit your own file for analysis.