Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c3f29cebfce840f…

MALICIOUS

PDF

15.0 KB Created: 2019-05-04 13:50:36 +01:00 Authoring application: mPDF 5.7
MD5: 53fd19a878d702b91c587891f76b850d SHA-1: cf0a0b30fa4b1416216a5d0dc8e09680345b667a SHA-256: 4c3f29cebfce840fd69ccc6882c0cc5affc6c748ad1a3958a3d8df57e3fbd15e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, forming a link farm. The heuristic PDF_SEO_LINK_FARM indicates this is a technique to distribute malicious content or for SEO manipulation. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, likely to redirect users to potentially harmful sites or to host further malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6090096094091095/Seven-Plays-of-Koffi-Kwahul-In-and-Out-of-Africa-by-Judith-G-Miller.pdf
    • http://loaminoo.linkpc.net/1093096099091092/Collected-Plays-1944-1961-by-Arthur-Miller.pdf
    • http://loaminoo.linkpc.net/7097094099098098/Francoise-Sagan-by-Judith-G-Miller.pdf
    • http://loaminoo.linkpc.net/4093097091098091/Myths-and-Legends-of-Southern-Africa-by-Penny-Miller.pdf
    • http://loaminoo.linkpc.net/5090090092097098/Somewhere-to-Belong-Daughters-of-Amana-Book-1-by-Judith-McCoy-Miller.pdf
    • http://loaminoo.linkpc.net/4091096095096098/A-Shining-Light-Home-to-Amana-3-by-Judith-McCoy-Miller.pdf
    • http://loaminoo.linkpc.net/3096093094094092/Healing-the-Western-Soul-A-Spiritual-Homecoming-for-Today-s-Seeker-by-Judith-S-Miller.pdf
    • http://loaminoo.linkpc.net/6094098090095/Short-Plays-to-Long-Remember-An-Eclectiic-Collection-of-Plays-by-Francine-L-Trevens.pdf
    • http://loaminoo.linkpc.net/9097091092097097/Fast-Horse-Plays-Round-One-A-Collection-of-One-Act-Plays-and-Poetry-by-Angeline-Brom.pdf
    • http://loaminoo.linkpc.net/8098091099098097/The-Greek-Plays-Sixteen-Plays-by-Aeschylus-Sophocles-and-Euripides-by-Mary-Lefkowitz.pdf
    • http://loaminoo.linkpc.net/4099094095092098/The-Collected-Plays-Vol-1-The-Early-Plays-1936-1952-by-Terence-Rattigan.pdf
    • http://loaminoo.linkpc.net/4099094092098098/The-Collected-Plays-Vol-2-The-Later-Plays-1953-1977-by-Terence-Rattigan.pdf
    • http://loaminoo.linkpc.net/7099093096098090/Captured-by-K-E-A-Koffi.pdf
    • http://loaminoo.linkpc.net/7099093096095092/death-of-a-thug-by-Koffi-Hallman.pdf
    • http://loaminoo.linkpc.net/7099093094099091/Death-of-a-Thug-by-Koffi-Hallman.pdf
    • http://loaminoo.linkpc.net/7099093094091096/Koffi-and-the-Crow-by-Peggy-Appiah.pdf
    • http://loaminoo.linkpc.net/7099093094099090/Que-Sait-On-De-La-Pollution-Photochimique-Urbaine-by-Brigitte-Koffi.pdf
    • http://loaminoo.linkpc.net/7099093095095090/African-Savannah-Stories-Volume-2-of-2-by-Koffi-Mbairamadji.pdf
    • http://loaminoo.linkpc.net/7099093096094099/Quand-L-Ecole-Se-Prend-En-Main-by-Vivi-Koffi.pdf
    • http://loaminoo.linkpc.net/7099093094092093/KOFFI-PT-I-An-E-Book-Short-Story-Drama-Series-by-Mahogani-P-.pdf
    • http://loaminoo.linkpc.net/4099094095092098/The-Collected-Plays-Vol-1-The-Early-Plays-1936-1952-by-Te

Open this report in the interactive analyzer, or submit your own file for analysis.