Malicious PDF — malware analysis report

Static analysis result for SHA-256 41c5992cebd2b1f8…

MALICIOUS

PDF

14.3 KB Created: 2019-05-01 23:56:28 +01:00 Authoring application: mPDF 5.7
MD5: 4a6cf14e39c12779571ca805cce8c8bf SHA-1: ec2b8b3c2911b17e84969818883103bd84bdfb4b SHA-256: 41c5992cebd2b1f888e8d28857be8a87cad08ee508ad6237da096a4289755cec
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to a single domain, indicative of a link farm or SEO manipulation tactic. While the URLs themselves are marked as benign, the sheer volume and the nature of the heuristic firing suggest a malicious intent to either drive traffic or potentially host malicious content under the guise of legitimate-looking book titles. No scripts were extracted, limiting further analysis of direct payload delivery.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6094098093094095/Lisa-Lopes-The-Life-of-a-Supernova-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/4091095095097097/The-Lycan-Chronicles-by-Nancy-A-Lopes.pdf
    • http://loaminoo.linkpc.net/1090097092095090/She-s-Got-the-Beat-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/3091097094090095/Witch-Switch-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/1099097098098090/Ripped-at-the-Seams-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/6099093097091099/The-Skateboard-Dare-Lassie-5-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/3097097093096097/Anyone-But-Me-Katie-Kazoo-Switcheroo-1-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/6099093097091095/Digging-Up-Danger-Lassie-2-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/2092097097093090/The-New-Girl-How-I-Survived-Middle-School-4-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/1093093095099098/Can-You-Get-An-F-In-Lunch-How-I-Survived-Middle-School-1-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/1091096099094098095/The-Case-of-the-Beagle-Burglar-Jack-Gets-a-Clue-1-by-Nancy-E-Krulik.pdf
    • http://loaminoo.linkpc.net/1091097097093090/Supernova-by-Crystal-Ward.pdf
    • http://loaminoo.linkpc.net/6098098092097/Nexus-Supernova-Saga-3-by-C-L-Parker.pdf
    • http://loaminoo.linkpc.net/6099094095096097/Limos-Lattes-amp-My-Life-on-the-Fringe-Real-Life-4-by-Nancy-N-Rue.pdf
    • http://loaminoo.linkpc.net/1090093094096091099/Mountainbike-Alles-was-du-wissen-musst-by-Brian-Lopes.pdf
    • http://loaminoo.linkpc.net/4098093092093090/The-Window-to-My-Soul-My-Walk-with-Jesus-by-Tannia-E-Ortiz-Lop-s.pdf
    • http://loaminoo.linkpc.net/2093097090092096/Dancing-on-Live-Embers-Challenging-Racism-in-Organizations-by-Tina-Lopes.pdf
    • http://loaminoo.linkpc.net/3090097096096091/Life-s-Breath-by-Nancy-Wald.pdf
    • http://loaminoo.linkpc.net/1098095090099090/The-Secret-Life-of-Squirrels-by-Nancy-Rose.pdf
    • http://loaminoo.linkpc.net/9092098098091093/The-Life-and-Times-of-Persimmon-Wilson-by-Nancy-Peacock.pdf
    • http://loaminoo.linkpc.net/6099094095096097/Limos-Lattes-amp-My-Life-on-the-Frin

Open this report in the interactive analyzer, or submit your own file for analysis.