Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ceaa5f72ad7900f…

MALICIOUS

PDF

13.5 KB Created: 2019-04-30 02:25:13 +01:00 Authoring application: mPDF 5.7
MD5: 602e00e986822c41f04860269a1c92c0 SHA-1: c1509bad0ad988a14b38a8c676f864fe805613c5 SHA-256: 8ceaa5f72ad7900f84a1f3cb627ced11ba4468c3b7902b85ace50f30bcb1b854
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on the domain loaminoo.linkpc.net. This heuristic firing indicates a link farm, likely intended to drive traffic or distribute further malicious content. No scripts were extracted from this sample. The primary attack pattern observed is the creation of a link farm within the document.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4097096098098095/Murder-Now-and-Then-Lloyd-amp-Hill-6-by-Jill-McGown.pdf
    • http://loaminoo.linkpc.net/2096099093098094/Gone-to-Her-Death-Lloyd-amp-Hill-3-by-Jill-McGown.pdf
    • http://loaminoo.linkpc.net/3097091092098092/Murder-at-the-Old-Vicarage-Lloyd-amp-Hill-2-by-Jill-McGown.pdf
    • http://loaminoo.linkpc.net/3092093094099094/Your-Mother-Was-a-Neanderthal-Time-Warp-Trio-r-i-Time-Warp-Trio-4-by-Jon-Scieszka.pdf
    • http://loaminoo.linkpc.net/4090095092093098/The-Storm-Murders-The-Storm-Murders-Trilogy-1-by-John-Farrow.pdf
    • http://loaminoo.linkpc.net/2094094091097092/Jill-s-Riding-Club-Jill-s-Ponies-5-by-Ruby-Ferguson.pdf
    • http://loaminoo.linkpc.net/2094094091097099/Jill-s-Pony-Trek-Jill-s-Ponies-9-by-Ruby-Ferguson.pdf
    • http://loaminoo.linkpc.net/3093097091096099/H-E-R-O-E-S-Trio-1-by-Kevin-Lee.pdf
    • http://loaminoo.linkpc.net/1095098093091091/The-Mitford-Murders-Mitford-Murders-1-by-Jessica-Fellowes.pdf
    • http://loaminoo.linkpc.net/4091092098094094/The-New-Girl-Alpha-Trio-2-by-Ana-Vela.pdf
    • http://loaminoo.linkpc.net/3092093092096099/Tut-Tut-Time-Warp-Trio-6-by-Jon-Scieszka.pdf
    • http://loaminoo.linkpc.net/1094098090090/The-Feel-Trio-by-Fred-Moten.pdf
    • http://loaminoo.linkpc.net/2090096090093097/A-Perfect-Trio-by-Jade-Belfry.pdf
    • http://loaminoo.linkpc.net/5090091099096095/Wheel-of-Fortune-A-Western-Trio-by-Max-Brand.pdf
    • http://loaminoo.linkpc.net/5095095092094097/The-Beaux-Arts-Trio-by-Nicholas-Delbanco.pdf
    • http://loaminoo.linkpc.net/7092093090091094/Trio-A-Novel-Biography-of-the-Schumanns-and-Brahms-by-Boman-Desai.pdf
    • http://loaminoo.linkpc.net/1091090099091091097/Dead-To-Me-A-Trio-of-Chilling-Tales-by-Kelley-Armstrong.pdf
    • http://loaminoo.linkpc.net/3092093092099097/Viking-It-and-Liking-It-Time-Warp-Trio-12-by-Jon-Scieszka.pdf
    • http://loaminoo.linkpc.net/3096095096099096/Coming-Clean-Monkey-Business-Trio-3-by-C-L-Parker.pdf
    • http://loaminoo.linkpc.net/8090096092097/The-Not-So-Jolly-Roger-Time-Warp-Trio-2-by-Jon-Scieszka.pdf
    • http://loaminoo.linkpc.net/2090096090093097/A-Perfect-Trio-by-Jade-

Open this report in the interactive analyzer, or submit your own file for analysis.