Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ce4a46102f59a41…

MALICIOUS

PDF

19.6 KB Created: 2019-05-01 22:07:42 +01:00 Authoring application: mPDF 5.7
MD5: 635b14ebb121d14b2b7508dc384e7435 SHA-1: a4d3c7caa8ed60641ffa8e1d37f112316aca1068 SHA-256: 8ce4a46102f59a419cab4c08428646f0c534392320112f95b6f50bba018e7eb4
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF documents hosted on loaminoo.linkpc.net. The document body confirms the presence of these URLs, suggesting a link farm or redirection strategy. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5099094097091096/Quicklet-on-Marjane-Satrapi-s-Persepolis-by-Natacha-Pavlov.pdf
    • http://loaminoo.linkpc.net/3095098090099/Persepolis-2-The-Story-of-a-Return-Persepolis-2-by-Marjane-Satrapi.pdf
    • http://loaminoo.linkpc.net/3093091098091/Persepolis-The-Story-of-a-Childhood-Persepolis-1-by-Marjane-Satrapi.pdf
    • http://loaminoo.linkpc.net/3092098097097/The-Complete-Persepolis-by-Marjane-Satrapi.pdf
    • http://loaminoo.linkpc.net/1098099092093093/Persepolis-The-Story-of-a-Childhood-and-the-Story-of-a-Return-by-Marjane-Satrapi.pdf
    • http://loaminoo.linkpc.net/4095092094090095/Embroideries-by-Marjane-Satrapi.pdf
    • http://loaminoo.linkpc.net/2096099093094097/Embroideries-by-Marjane-Satrapi.pdf
    • http://loaminoo.linkpc.net/5099094097090099/Monsters-Are-Afraid-of-the-Moon-by-Marjane-Satrapi.pdf
    • http://loaminoo.linkpc.net/5099094097096098/Graphic-Novelists-Book-Guide-Kia-Asamiya-Akira-Toriyama-Hugo-Pratt-Osamu-Tezuka-Jerome-Charyn-Marjane-Satrapi-Joe-Sacco-Ted-Dekker-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/5099094097097090/Articles-on-Iranian-Women-Writers-Including-Azar-Nafisi-Marjane-Satrapi-Ta-Hirih-Zahra-Rahnavard-Simin-Behbahani-Farzaneh-Aghaeipour-Parvin-E-Tesami-Rabeah-Ghaffari-Azadeh-Moaveni-Roya-Hakakian-Lady-Amin-Simin-Daneshvar-by-Hephaestus-Books.pdf
    • http://loaminoo.linkpc.net/6092090094099091/Persepolis-Concluded-Persepolis-Series-by-Veronica-Platzer.pdf
    • http://loaminoo.linkpc.net/5090098095099092/Requiem-for-a-Soldier-by-Oleg-Pavlov.pdf
    • http://loaminoo.linkpc.net/1090095097094092097/Quicklet-on-Mohsin-Hamid-s-The-Reluctant-Fundamentalist-by-Elizabeth-Shestakova.pdf
    • http://loaminoo.linkpc.net/7095094094099091/The-Ultimate-TED-Talks-Quicklet-Bundle---Dan-Pink-Dan-Gilbert-Chimamanda-Adichie-by-Karen-Lac.pdf
    • http://loaminoo.linkpc.net/1090095096096093097/Pavlov-s-Dogs-and-Schr-dinger-s-Cat-Scenes-from-the-Living-Laboratory-by-Rom-Harr-.pdf
    • http://loaminoo.linkpc.net/2090090093099099/Ivan-Pavlov-A-Russian-Life-in-Science-by-Daniel-P-Todes.pdf
    • http://loaminoo.linkpc.net/7093092090097094/The-Snow-Queen-by-Natacha-Godeau.pdf
    • http://loaminoo.linkpc.net/8090090093099093/Les-amants-de-Troie-by-Natacha-J-Collins.pdf
    • http://loaminoo.linkpc.net/7099092094097093/Madame-de-Stael-by-Natacha-Molina.pdf
    • http://loaminoo.linkpc.net/2093099091096091/Yellowstone-Has-Teeth-by-Marjane-Ambler.pdf