Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ffe6c89be6d1a93…

MALICIOUS

PDF

18.3 KB Created: 2019-05-04 14:08:02 +01:00 Authoring application: mPDF 5.7
MD5: 76218b3feaaa0b341561782496f1a76a SHA-1: a0e786b6aab92b736b7ecd8036bd991bad30a23e SHA-256: 9ffe6c89be6d1a93ab2222036b9d6dfcd9625c8094b8dfe3c1485580252f3253
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection mechanism. ClamAV also detected this as Pdf.Dropper.Agent-7093697-0. The embedded URLs, while currently flagged as benign, are part of a pattern indicative of a dropper or downloader attempting to lead the user to malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7093697-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7093697-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9095097093092/Extended-Play-The-Elastic-Book-of-Music-by-Gary-Couzens.pdf
    • http://loaminoo.linkpc.net/9095097093095/The-Elastic-Book-Of-Numbers-by-Marion-Arnott.pdf
    • http://loaminoo.linkpc.net/6093093093094094/Music-Hound-Rock-The-Essential-Album-Guide-by-Gary-Graff.pdf
    • http://loaminoo.linkpc.net/8096098099092099/The-perfect-Play---Spiel-mit-der-Liebe-Play-by-Play-1-by-Jaci-Burton.pdf
    • http://loaminoo.linkpc.net/9093095099096099/Reflections-on-American-Music-The-Twentieth-Century-and-the-New-Millennium-A-Collection-of-Essays-Presented-in-Honor-of-the-College-Music-Society-Cms-Bibliographies-in-American-Music-No-16-by-Michael-Benton-Saffle.pdf
    • http://loaminoo.linkpc.net/2098092093091095/In-Touch-Play-On-Book-1-by-C-D-Brennan.pdf
    • http://loaminoo.linkpc.net/3091092094090094/Your-Fantastic-Elastic-Brain-Stretch-It-Shape-It-by-JoAnn-Deak.pdf
    • http://loaminoo.linkpc.net/8092092090094093/The-Rembrandt-Book-by-Gary-D-Schwartz.pdf
    • http://loaminoo.linkpc.net/3092095098098096/The-War-Play-to-Live-A-LitRPG-Series-Book-6-by-D-Rus.pdf
    • http://loaminoo.linkpc.net/8095090091091092/Body-Play-The-Book-by-Fakir-Musafar.pdf
    • http://loaminoo.linkpc.net/7095094091093093/It-Could-Have-Been-You-Gary-Thibodeau-Saga-Book-2-by-T-Priest.pdf
    • http://loaminoo.linkpc.net/9090097098091096/More-Easy-Classics-to-Moderns-Music-for-Millions-Vol-27-Music-for-Milions-Music-for-Milions-by-A-Traum.pdf
    • http://loaminoo.linkpc.net/5093092090091097/The-Clan-Play-to-Live-A-LitRPG-Series-Book-2-by-D-Rus.pdf
    • http://loaminoo.linkpc.net/9094097094097097/The-Katy-Kruse-Play-Book-by-Rose-Fyleman.pdf
    • http://loaminoo.linkpc.net/2094094099090093/The-Sisterhood-She-Shall-Have-Music---Book-Two-by-Will-Lowtide.pdf
    • http://loaminoo.linkpc.net/9092097097095097/A-Most-Wicked-God-A-Gladius-Dei-Adventure---Book-2-by-Gary-Dias.pdf
    • http://loaminoo.linkpc.net/4095093096092096/This-Book-Does-Not-Exist-Adventures-In-The-Paradoxical-by-Gary-Hayden.pdf
    • http://loaminoo.linkpc.net/8092093098090092/Shadow-Play-The-Doms-of-Drakos-Book-Two-by-Ellen-March.pdf
    • http://loaminoo.linkpc.net/1091093097092093094/Extended-Matching-Questions-in-Ophthalmology-by-Tariq-Ayoub.pdf
    • http://loaminoo.linkpc.net/3092094094090097/Hollow-World-Extended-Preview-by-Michael-J-Sullivan.pdf
    • http://loaminoo.linkpc.net/3091092094090094/Your-

Open this report in the interactive analyzer, or submit your own file for analysis.