Malicious PDF — malware analysis report

Static analysis result for SHA-256 992b22b6652cb39e…

MALICIOUS

PDF

17.4 KB Created: 2019-05-02 17:35:15 +01:00 Authoring application: mPDF 5.7
MD5: 45c350a1a60a07f031f9898d7c571470 SHA-1: c76a9ca8a81ef58b8c1c7ce0b612ab1ccf90930e SHA-256: 992b22b6652cb39ee85a13802658dbad64e1be7a529ee82110830ea066b54412
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm with 24 links. While the document body is heavily obfuscated and unreadable, the presence of numerous links suggests a deceptive or manipulative purpose. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4096099097090091/Anne-Perry-s-Christmas-Vigil-A-Christmas-Promise-A-Christmas-Odyssey-Christmas-Stories-7-8-by-Anne-Perry.pdf
    • http://loaminoo.linkpc.net/4098090095093095/The-True-Story-of-Christmas-by-Nelle-Navillus.pdf
    • http://loaminoo.linkpc.net/3094092097099094/Intermission-A-True-Story-by-Anne-Baxter.pdf
    • http://loaminoo.linkpc.net/2098096093091/Trash-A-True-Story-by-Laurie-Anne-Hoover.pdf
    • http://loaminoo.linkpc.net/3096093099098091/First-Christmas-The-True-yet-Unfamiliar-Story-of-Christ-s-Birth-by-Paul-L-Maier.pdf
    • http://loaminoo.linkpc.net/6098098097090098/Hey-Charleston-The-True-Story-of-the-Jenkins-Orphanage-Band-by-Anne-Rockwell.pdf
    • http://loaminoo.linkpc.net/1090097098099096092/It-Must-Be-Christmasitis-An-Almost-True-Story-of-Christmas-at-Our-Home-December-1989-by-Becky-Guthrie.pdf
    • http://loaminoo.linkpc.net/4098090095092099/The-Meaning-of-our-Tears-the-True-Story-of-the-Lawson-Family-Murders-Christmas-Day-1929-by-Trudy-J-Smith.pdf
    • http://loaminoo.linkpc.net/4096093090092095/Bad-Dreams-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/1091095098093096093/A-Spy-Called-James-The-True-Story-of-James-Armistead-Lafayette-Revolutionary-War-Double-Agent-by-Anne-Rockwell.pdf
    • http://loaminoo.linkpc.net/3091097096095/Blood-Family-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/1098090099093090/Roll-Over-Roly-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/1091095096093095095/Our-Precious-Lulu-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/3099095099097092/The-Road-of-Bones-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/3091098095099/Trouble-in-Toadpool-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/5092092094096099/How-To-Write-Really-Badly-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/4095090090099091/Taking-the-Devil-s-Advice-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/3097093090096090/A-Christmas-Journey-Christmas-Stories-1-by-Anne-Perry.pdf
    • http://loaminoo.linkpc.net/3099095097098099/A-Christmas-Garland-Christmas-Stories-10-by-Anne-Perry.pdf
    • http://loaminoo.linkpc.net/3098094095091091/A-Christmas-Beginning-Christmas-Stories-5-by-Anne-Perry.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.