Malicious PDF — malware analysis report

Static analysis result for SHA-256 541cae29098df74b…

MALICIOUS

PDF

15.0 KB Created: 2019-05-02 01:00:45 +01:00 Authoring application: mPDF 5.7
MD5: 6ddb65092e6425daf5a7fd2dbb027a0a SHA-1: 8e8de02e3b4233edf955e3dc2e8a961841bb6cda SHA-256: 541cae29098df74b0d19a2219c54a6b4876af7078907e86450de2bf5a85568c5
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF documents hosted on loaminoo.linkpc.net. While the individual linked PDFs are marked as benign, the sheer volume and structure suggest a link farm or a method to distribute content, potentially as a lure or to manipulate search engine rankings. No scripts were extracted, and the document body primarily consists of these links and metadata.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9094092098098092/Knopf-Guide-Scotland-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/7093094093098095/Knopf-Guide-Athens-and-the-Peloponnese-Knopf-Guides-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/9094092097095095/Knopf-Guide-New-York-Knopf-Guides-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/9094092098091096/Knopf-Guide-Athens-Knopf-Guides-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/9094092098097094/Knopf-City-Guide-Tokyo-Knopf-City-Guides-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/9094092097096092/Knopf-MapGuide-Munich-Knopf-Mapguides-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/9094092098091098/Knopf-MapGuide-Venice-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/9094092098092096/Knopf-Mapguides-Berlin-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/9094092098093092/Knopf-Mapguide-Knopf-Mapguide-Series-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/7090090092097090/Paramore---Riot-by-Alfred-A-Knopf-Publishing-Company.pdf
    • http://loaminoo.linkpc.net/9094092098093091/Knopf-MapGuide-Bangkok-Knopf-Mapguides-by-Knopf-Guides.pdf
    • http://loaminoo.linkpc.net/9094092097091092/Knopf-MapGuide-Barcelona-Knopf-Mapguides-by-Knopf-Guides.pdf
    • http://loaminoo.linkpc.net/9094092098092098/Knopf-Guide-to-The-Holy-Land-by-Knopf-Guides.pdf
    • http://loaminoo.linkpc.net/9094092097095099/Knopf-MapGuide-Rome-by-Knopf-Guides.pdf
    • http://loaminoo.linkpc.net/9094092098098094/Two-Time-by-Chris-Knopf.pdf
    • http://loaminoo.linkpc.net/7097092092098099/The-Last-Refuge-by-Chris-Knopf.pdf
    • http://loaminoo.linkpc.net/9094092099094094/Head-Wounds-by-Chris-Knopf.pdf
    • http://loaminoo.linkpc.net/9094092099094092/Hard-Stop-by-Chris-Knopf.pdf
    • http://loaminoo.linkpc.net/2091099097098/The-Kingfisher-Knopf-Poetry-Series-by-Amy-Clampitt.pdf
    • http://loaminoo.linkpc.net/9094092098092093/Short-Squeeze-Jackie-Swaitkowski-1-by-Chris-Knopf.pdf
    • http://loaminoo.linkpc.net/9094092098093091/Knopf-MapGuide-Bangkok-Knopf-

Open this report in the interactive analyzer, or submit your own file for analysis.