Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f1f853d5b3133a5…

MALICIOUS

PDF

20.1 KB Created: 2019-04-30 04:46:35 +01:00 Authoring application: mPDF 5.7
MD5: 4c47d741bc08ac4f579b9727b6e56455 SHA-1: 70c29808361dcf7d8faa30b3729552b541db34a8 SHA-256: 9f1f853d5b3133a5e4428fcd28c6b5cd9761999c42b43b8e66da56aafe5eed6e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While many of these URLs themselves are marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO poisoning or to act as a lure for further malicious activity. No scripts were extracted from this sample. The attack pattern is inferred from the heuristic firing and the presence of numerous external links.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc
    • http://loaminoo.linkpc.net/9095097099/The-Romanov-Sisters-The-Lost-Lives-of-the-Daughters-of-Nicholas-and-Alexandra-by-Helen-Rappaport.pdf
    • http://loaminoo.linkpc.net/8099097095090092/As-irm-s-Romanov-A-vida-das-filhas-do-ltimo-tsar-by-Helen-Rappaport.pdf
    • http://loaminoo.linkpc.net/4098097090098093/Nicholas-and-Alexandra-by-Robert-K-Massie.pdf
    • http://loaminoo.linkpc.net/6091096097093/Nicholas-and-Alexandra-by-Robert-K-Massie.pdf
    • http://loaminoo.linkpc.net/9092099097097/Daughters-of-Dracula-The-Stoker-Sisters-1-by-Kailin-Gow.pdf
    • http://loaminoo.linkpc.net/4095090095092090/Lady-Alexandra-s-Lover-by-Helen-Hardt.pdf
    • http://loaminoo.linkpc.net/1095093097097093/Royal-Sisters-The-Story-of-the-Daughters-of-James-II-by-Jean-Plaidy.pdf
    • http://loaminoo.linkpc.net/3090093093097099/My-Daughter-My-Joy-The-Greatest-Tributes-to-Daughters-That-Have-Ever-Been-Written-by-Helen-Exley.pdf
    • http://loaminoo.linkpc.net/4090098097099094/Children-of-the-Holocaust-Conversations-with-Sons-and-Daughters-of-Survivors-by-Helen-Epstein.pdf
    • http://loaminoo.linkpc.net/3099095093092095/Followng-The-Drum-The-Lives-of-Army-Wives-and-Daughters-Past-and-Present-by-Annabel-Venning.pdf
    • http://loaminoo.linkpc.net/5098097091/What-I-Lost-by-Alexandra-Ballard.pdf
    • http://loaminoo.linkpc.net/2098095099097098/Excellent-Daughters-The-Secret-Lives-of-Young-Women-Who-Are-Transforming-the-Arab-World-by-Katherine-Zoepf.pdf
    • http://loaminoo.linkpc.net/3092093092091090/Three-Sisters-Emily-Castles-Mysteries-1-by-Helen-Smith.pdf
    • http://loaminoo.linkpc.net/5092092090/Their-Lost-Daughters-DI-Jackman-amp-DS-Evans-2-by-Joy-Ellis.pdf
    • http://loaminoo.linkpc.net/8097094090094/You-Were-Always-Mom-s-Favorite-Sisters-in-Conversation-Throughout-Their-Lives-by-Deborah-Tannen.pdf
    • http://loaminoo.linkpc.net/2099093091092092/Lost-by-Helen-R-Myers.pdf
    • http://loaminoo.linkpc.net/2097095092092090/Rapunzel-s-Daughters-What-Women-s-Hair-Tells-Us-About-Women-s-Lives-by-Rose-Weitz.pdf
    • http://loaminoo.linkpc.net/3091094092094092/The-Lost-Garden-by-Helen-Humphreys.pdf
    • http://loaminoo.linkpc.net/4098099092090096/The-Prince-Lost-to-Time-Nicholas-Segalla-2-by-Ann-Dukthas.pdf
    • http://loaminoo.linkpc.net/7099096091/Daughters-of-the-Winter-Queen-Four-Remarkable-Sisters-the-Crown-of-Bohemia-and-the-Enduring-Legacy-of-Mary-Queen-of-Scots-by-Nancy-Goldstone.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.