Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d3f19386b078a1a…

MALICIOUS

PDF

16.2 KB Created: 2019-05-02 05:24:42 +01:00 Authoring application: mPDF 5.7
MD5: 8c486a4a7610cfba5dc4e2c5bd082605 SHA-1: f7776ff44f29de920aaafe5c7d8bb990dd6f532b SHA-256: 9d3f19386b078a1a4e30b3537a77d89ae4bf3fe5024b19fd38e15a278008d294
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, suggesting a link farm or redirection mechanism. The heuristic PDF_SEO_LINK_FARM indicates a mass external PDF link farm, with the dominant host being loaminoo.linkpc.net. While the extracted URLs are labeled as confirmed benign, the sheer volume and the use of a dynamic DNS domain are suspicious. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4095093093097094/I-ll-Be-Home-For-Christmas-by-Adrianna-Dane.pdf
    • http://loaminoo.linkpc.net/2093095095095095/Captivity-by-Adrianna-Dane.pdf
    • http://loaminoo.linkpc.net/5095091095091096/Sylvie-s-Gift-by-Adrianna-Dane.pdf
    • http://loaminoo.linkpc.net/2095097096098/Virgin-Blood-Zytarri-1-by-Adrianna-Dane.pdf
    • http://loaminoo.linkpc.net/2095097093094092/Carved-In-Memory-The-Exile-2-by-Adrianna-Dane.pdf
    • http://loaminoo.linkpc.net/5091096090096099/Snow-Falling-On-Lovers-by-Adrianna-Dane.pdf
    • http://loaminoo.linkpc.net/2092095091092099/A-Bride-By-Christmas-Home-For-Christmas-The-Wise-Virgin-Tumbleweed-Christmas-by-Heather-Graham.pdf
    • http://loaminoo.linkpc.net/2099096097090093/Home-For-Christmas-Bar-V5-Dude-Ranch-1-Copper-Mountain-Christmas-2-by-Melissa-McClone.pdf
    • http://loaminoo.linkpc.net/5090090091096097/I-ll-Be-Home-for-Christmas-Silver-Bells-On-a-Snowy-Christmas-The-Perfect-Holiday-by-Debbie-Macomber.pdf
    • http://loaminoo.linkpc.net/3090096097090098/I-ll-Be-Home-For-Christmas-Coming-Home-0-5-by-Jessica-Scott.pdf
    • http://loaminoo.linkpc.net/3097094090091091/Coming-Home-for-Christmas-by-Agatha-Rae.pdf
    • http://loaminoo.linkpc.net/2092095091096092/Home-by-Christmas-by-Rory-Church.pdf
    • http://loaminoo.linkpc.net/3093097091095095/Home-for-Christmas-by-Holly-Chamberlin.pdf
    • http://loaminoo.linkpc.net/2095099094093099/Home-for-Christmas-by-Nora-Roberts.pdf
    • http://loaminoo.linkpc.net/3098094099095095/Home-for-Christmas-by-Andrew-M-Greeley.pdf
    • http://loaminoo.linkpc.net/4099095090096098/I-ll-Be-Home-For-Christmas-by-Jeffrey-Miller.pdf
    • http://loaminoo.linkpc.net/3091096093090096/A-Friend-Like-Ben-the-Cat-That-Came-Home-for-Christmas-by-Julia-Romp.pdf
    • http://loaminoo.linkpc.net/1090096092095091093/Coming-Home-for-Christmas-454-by-Laura-Martin.pdf
    • http://loaminoo.linkpc.net/3097099093090098/Home-for-Christmas-Article-Row-2-by-Annie-Groves.pdf
    • http://loaminoo.linkpc.net/2096098096094097/By-the-Fireside-Christmas-at-Home-by-Better-Homes-and-Gardens.pdf
    • http://loaminoo.linkpc.net/5090090091096097/I-ll-Be-Home-for-Christmas-Silver-Bells-On-a-Snowy-Christmas-The-Perfect-Holiday-by-

Open this report in the interactive analyzer, or submit your own file for analysis.