Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d99e7d30cf0d0d4…

MALICIOUS

PDF

15.6 KB Created: 2019-05-02 04:52:12 +01:00 Authoring application: mPDF 5.7
MD5: 4c08a9c26fbc3712a09a3620365eac85 SHA-1: 0f7376240d6a4fab3ba680662e5656ed9c94e8ee SHA-256: 9d99e7d30cf0d0d4c606e86dcc3cb4cbfbacc34c3805cf5cb30879ef4043fd57
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, hosted on a dynamic DNS domain. This pattern is indicative of SEO poisoning or a traffic generation scheme. While the specific URLs are marked as benign, the sheer volume and nature of the links suggest a malicious intent to drive traffic or manipulate search results. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1095097094091/Mussolini-and-Fascism-The-View-from-America-by-John-Patrick-Diggins.pdf
    • http://loaminoo.linkpc.net/8095090094097099/Writings-of-John-Quincy-Adams-Volume-7-1820-1823-by-John-Quincy-Adams.pdf
    • http://loaminoo.linkpc.net/4097095099095091/Diary-and-Autobiography-of-John-Adams-Volumes-1-4-Diary-1755-1804-and-Autobiography-Through-1780-by-John-Adams.pdf
    • http://loaminoo.linkpc.net/6092090095094/John-Patrick-Norman-McHennessy-The-Boy-Who-Was-Always-Late-by-John-Burningham.pdf
    • http://loaminoo.linkpc.net/3093092099097090/John-Adams-A-Life-by-John-Ferling.pdf
    • http://loaminoo.linkpc.net/1094094090099099/Mr-Adams-s-Last-Crusade-The-Extraordinary-Post-presidential-Life-of-John-Quincy-Adams-by-Joseph-Wheelan.pdf
    • http://loaminoo.linkpc.net/3098097093090093/The-End-Is-Nigh-by-John-Joseph-Adams.pdf
    • http://loaminoo.linkpc.net/7093096094091095/John-Adams-by-David-McCullough.pdf
    • http://loaminoo.linkpc.net/1096090091097/John-Adams-by-Page-Smith.pdf
    • http://loaminoo.linkpc.net/6091091093097092/John-Adams-Part-2-of-2-by-David-McCullough.pdf
    • http://loaminoo.linkpc.net/2092093098090090/Seeds-of-Change-by-John-Joseph-Adams.pdf
    • http://loaminoo.linkpc.net/1095094093098095/Brave-New-Worlds-by-John-Joseph-Adams.pdf
    • http://loaminoo.linkpc.net/8099091099093094/To-Fail-With-Flying-Colors-by-Paul-John-Adams.pdf
    • http://loaminoo.linkpc.net/1091095096099090093/Sam-Adams-Pioneer-in-Propaganda-by-John-Chester-Miller.pdf
    • http://loaminoo.linkpc.net/3097091090092091/Revolutionary-Writings-1775-1783-by-John-Adams.pdf
    • http://loaminoo.linkpc.net/1090095091094/First-Family-Abigail-and-John-Adams-by-Joseph-J-Ellis.pdf
    • http://loaminoo.linkpc.net/3097091090091095/Revolutionary-Writings-1755-1775-by-John-Adams.pdf
    • http://loaminoo.linkpc.net/4099094095094098/The-Curious-Savage-by-John-Patrick.pdf
    • http://loaminoo.linkpc.net/2094090094095095/Doubt-by-John-Patrick-Shanley.pdf
    • http://loaminoo.linkpc.net/2096096097094/Lightspeed-Magazine-June-2013-by-John-Joseph-Adams.pdf
    • http://loaminoo.linkpc.net/609

Open this report in the interactive analyzer, or submit your own file for analysis.