Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e4ebc3f1dec1d25…

MALICIOUS

PDF

15.9 KB Created: 2019-04-30 17:29:23 +01:00 Authoring application: mPDF 5.7
MD5: 8071b91eb8170e4d8a21f828a7c8d14f SHA-1: b9d91c1132b7b2633261f0fd53707b93de623e77 SHA-256: 3e4ebc3f1dec1d2528f08d6ea2662e46bc2b994fe4aa1da9d6b1760b5d6a44b4
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified as a link farm. The primary heuristic indicates this is likely for SEO manipulation or to distribute malicious content. While no scripts were extracted, the sheer volume of links suggests a delivery mechanism for further payloads or phishing attempts. The URLs themselves are not directly malicious but serve as the distribution vector.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2092099098092090/The-Richard-Laymon-Collection-Volume-1-The-Beast-House-Trilogy-The-Cellar---The-Beast-House---The-Midnight-Tour-Richard-Laymon-Collection-1-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/2095097097092099/Venetia-Kelly-s-Traveling-Show-A-Novel-of-Ireland-by-Frank-Delaney.pdf
    • http://loaminoo.linkpc.net/3097099091093098/Fiends-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/1096095096094092/The-Cellar-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/2091095097095092/After-Midnight-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/2091098096093091/Bite-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/2098095092097092/Island-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/3097097092094090/Resurrection-Dreams-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/1091097093095092/One-Rainy-Night-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/4093090099091/Endless-Night-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/1097096093093099/The-Midnight-Tour-by-Richard-Laymon.pdf
    • http://loaminoo.linkpc.net/2099098096094090/101-Tips-for-Traveling-with-a-Vampire-by-Joleene-Naylor.pdf
    • http://loaminoo.linkpc.net/1090097094099093097/Roglers-Freiheit-CD-Die-3sat--Satire--Show-von-und-mit-Richard-Rogler-und-G-sten-by-Richard-Rogler.pdf
    • http://loaminoo.linkpc.net/4096096098098094/The-Traveling-Man-Traveling-1-by-Jane-Harvey-Berrick.pdf
    • http://loaminoo.linkpc.net/1093095/The-Traveling-Man-Traveling-1-by-Jane-Harvey-Berrick.pdf
    • http://loaminoo.linkpc.net/3096093090094/The-Greatest-Show-on-Earth-The-Evidence-for-Evolution-by-Richard-Dawkins.pdf
    • http://loaminoo.linkpc.net/3099099097091095/The-Greatest-Show-on-Earth-The-Evidence-for-Evolution-by-Richard-Dawkins.pdf
    • http://loaminoo.linkpc.net/1095099098096091/Company-Aytch-or-a-Side-Show-of-the-Big-Show-A-Memoir-of-the-Civil-War-by-Sam-R-Watkins.pdf
    • http://loaminoo.linkpc.net/2094095096094093/Show-Me-the-Ashes-Show-Me-4-by-Carolyn-Mulford.pdf
    • http://loaminoo.linkpc.net/5090091099097/Vampire-Dreams-by-Richard-Reich.pdf
    • http://loaminoo.linkpc.net/209

Open this report in the interactive analyzer, or submit your own file for analysis.