Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a3d4379ba3e0984…

MALICIOUS

PDF

16.3 KB Created: 2019-04-30 05:01:03 +01:00 Authoring application: mPDF 5.7
MD5: 8736d61001cbd6125bca313a2d6b1474 SHA-1: ff81b727ea2382ebfb47cc418b5c2440cd9e4539 SHA-256: 4a3d4379ba3e09842d00487502b560babc0eb72a2ae8dc610b9bc9bf0231c538
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on loaminoo.linkpc.net. The purpose appears to be SEO manipulation or driving traffic to potentially malicious content, rather than delivering a direct payload. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1093095091098095/Redemption-Dark-Hunter-20-5-Dream-Hunter-5-5-Were-Hunter-6-5-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/3098099094093/The-Guardian-Dark-Hunter-20-Dream-Hunter-5-Were-Hunter-6-Hellchaser-3-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/3090091091091095/Dark-Bites-Dream-Hunter-1-Hellchaser-1-Were-Hunter-1-Dark-Hunter-2-5-2-6-7-5-9-5-9-6-10-5-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/4096098092094/Upon-the-Midnight-Clear-Dark-Hunter-12-Dream-Hunter-2-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/3090097093094091/Dream-Chaser-Dream-Hunter-3-Dark-Hunter-14-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/1099092090091093/The-Guardian-Dream-Hunter-5-Were-Hunter-9-Hellchaser-4-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/1096094099091096/Bad-Moon-Rising-Dark-Hunter-18-Were-Hunter-4-Hellchaser-2-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/2098090098094096/Unleash-the-Night-Dark-Hunter-9-Were-Hunter-4-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/4097094099097099/Dark-Side-of-the-Moon-Dark-Hunter-9-Were-Hunter-3-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/6092098090/Dragonsworn-Dark-Hunter-26-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/4097095090099/Styxx-Dark-Hunter-23-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/1092092090091091/Styxx-Dark-Hunter-23-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/8096098096097099/Gebieterin-der-Schatten-Dark-Hunter-15-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/2098099090090092/Kiss-of-the-Night-Dark-Hunter-5-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/1094098091098098/Dragonbane-Dark-Hunter-Novels-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/1099098099097096/Fantasy-Lover-Dark-Hunter-1-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/1091096094095093/Seize-the-Night-Dark-Hunter-5-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/1099091098095096/Night-Embrace-Dark-Hunter-2-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/4098090095090093/Night-Embrace-Dark-Hunter-2-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/3095092091093/Kiss-of-the-Night-Dark-Hunter-4-by-Sherrilyn-Kenyon.pdf
    • http://loaminoo.linkpc.net/4097094099097099/Dark-Side-of-the-Moon-Dark-Hun

Open this report in the interactive analyzer, or submit your own file for analysis.