Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e9ff8982f72cf9e…

MALICIOUS

PDF

19.7 KB Created: 2019-04-29 23:17:45 +01:00 Authoring application: mPDF 5.7
MD5: 3a3671b53cc98f78ec67eb34b07a36d6 SHA-1: d167161c80e0b1d6608c1331a30d9628f27850be SHA-256: 3e9ff8982f72cf9e210aa290ebc5d8b049676f1383115224b44afba36945e19f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles hosted on loaminoo.linkpc.net. While the individual URLs are marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or as a lure for further malicious activity. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4091098091095098/The-Travelers-Club-and-the-Ghost-Ship-by-Michael-Bradley.pdf
    • http://loaminoo.linkpc.net/3098098097094096/Ghost-Ship-s-Cry-by-Dawn-Luedecke.pdf
    • http://loaminoo.linkpc.net/6097096096098095/The-Ghost-Ship-of-Phobos-by-Kyle-Snyder.pdf
    • http://loaminoo.linkpc.net/4095090094099094/Ghost-Ship-NUMA-Files-12-by-Clive-Cussler.pdf
    • http://loaminoo.linkpc.net/3098099091095093/The-Ghost-Ship-Space-Drifters-3-by-Paul-Regnier.pdf
    • http://loaminoo.linkpc.net/2094096096094097/The-Traveling-Man-The-Travelers-1-by-Michael-P-King.pdf
    • http://loaminoo.linkpc.net/1093090097099092/The-Impostor-Liar-s-Club-2-by-Celeste-Bradley.pdf
    • http://loaminoo.linkpc.net/1092096095098096/The-Charmer-Liar-s-Club-4-by-Celeste-Bradley.pdf
    • http://loaminoo.linkpc.net/2095095097091/The-Lady-Travelers-Guide-to-Larceny-with-a-Dashing-Stranger-The-Lady-Travelers-Society-2-by-Victoria-Alexander.pdf
    • http://loaminoo.linkpc.net/2090094092094090/The-Lady-Travelers-Guide-to-Scoundrels-amp-Other-Gentlemen-The-Lady-Travelers-Society-1-by-Victoria-Alexander.pdf
    • http://loaminoo.linkpc.net/1090099098090096097/Off-the-Edge-of-the-Map-Marco-Polo-Captain-Cook-and-9-Other-Travelers-and-Explorers-That-Pushed-the-Boundaries-of-the-Known-World-by-Michael-Rank.pdf
    • http://loaminoo.linkpc.net/2092096096097093/The-Ghost-at-Dawn-s-House-The-Baby-Sitters-Club-9-by-Ann-M-Martin.pdf
    • http://loaminoo.linkpc.net/8096099093094/The-Truth-About-Cruise-Ships-A-Cruise-Ship-Officer-Survives-the-Work-Adventure-Alcohol-and-Sex-of-Ship-Life-by-Jay-Herring.pdf
    • http://loaminoo.linkpc.net/3098098090096096/Gap-Year-in-Ghost-Town-by-Michael-Pryor.pdf
    • http://loaminoo.linkpc.net/9096094098097093/The-Ghost-of-Caroline-Wald-by-Michael-E-Henderson.pdf
    • http://loaminoo.linkpc.net/3095094094098090/The-Poisoned-House-A-Ghost-Story-by-Michael-Ford.pdf
    • http://loaminoo.linkpc.net/3092098099094094/Chosen-People-from-the-Caucasus-Jewish-Origins-Delusions-Deceptions-and-Historical-Role-in-the-Slave-Trade-Genocide-and-Cultural-by-Michael-Anderson-Bradley.pdf
    • http://loaminoo.linkpc.net/1091094091098099093/The-Treasure-Hunt-Club-by-Michael-Scott-Clifton.pdf
    • http://loaminoo.linkpc.net/8093092098091094/The-Teddy-Bear-Club-The-Teddy-Bear-Club-1-by-Sean-Michael.pdf
    • http://loaminoo.linkpc.net/7091095099095095/The-Jacobin-Club-of-Marseilles-1790-1794-by-Michael-L-Kennedy.pdf
    • http://loaminoo.linkpc.net/2090094092094090/The-Lady-Trave

Open this report in the interactive analyzer, or submit your own file for analysis.