Malicious PDF — malware analysis report

Static analysis result for SHA-256 a283a10f1c87acd5…

MALICIOUS

PDF

17.6 KB Created: 2019-05-02 17:14:57 +01:00 Authoring application: mPDF 5.7
MD5: 456db9d50aa441076f9c5ba420c72557 SHA-1: 2991d9a8fcc453a123f2a45040440c610d52579a SHA-256: a283a10f1c87acd55aeec787630d2a56c8291078ceab312bbeb013c555d432f4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified as a link farm. This technique is often used to manipulate search engine rankings or to redirect users to malicious websites. The ClamAV detection 'Pdf.Dropper.Agent-7178220-0' further supports its malicious nature. No scripts were extracted, but the primary attack pattern involves the distribution of numerous external links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7178220-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7178220-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7099092099095093/The-Political-Testament-of-Cardinal-Richelieu-The-Significant-Chapters-and-Supporting-Selections-by-Armand-Jean-du-Plessis-de-Richelieu.pdf
    • http://loaminoo.linkpc.net/3091099097099094/Journey-of-Souls-by-Michael-Newton.pdf
    • http://loaminoo.linkpc.net/6094093096095/Journey-of-Souls-Case-Studies-of-Life-Between-Lives-by-Michael-Newton.pdf
    • http://loaminoo.linkpc.net/6093098096093/Journey-to-a-Hanging-by-Peter-Wells.pdf
    • http://loaminoo.linkpc.net/5095093091095097/ELIEZER-S-JOURNEY-by-Peter-N-Bernfeld.pdf
    • http://loaminoo.linkpc.net/4092097098096095/Journey-of-a-Thousand-Miles-by-Peter-Kasting.pdf
    • http://loaminoo.linkpc.net/3091090099094098/Secret-of-the-Souls-Pool-of-Souls-2-by-Terri-Rochenski.pdf
    • http://loaminoo.linkpc.net/1091097090099096096/One-s-Company-A-Journey-to-China-in-1933-by-Peter-Fleming.pdf
    • http://loaminoo.linkpc.net/4091091098091/Shattered-Souls-Souls-1-by-Mary-Lindsey.pdf
    • http://loaminoo.linkpc.net/2090097092090096/Obsidian-Souls-Souls-1-by-Donna-Augustine.pdf
    • http://loaminoo.linkpc.net/1095099093090/Journey-to-the-Frontier-Two-Roads-to-the-Spanish-Civil-War-by-Peter-Stansky.pdf
    • http://loaminoo.linkpc.net/6099092091093091/On-The-Spartacus-Road-a-Journey-Through-Ancient-Italy-by-Peter-Stothard.pdf
    • http://loaminoo.linkpc.net/9099095097095098/The-Planter-s-Bungalow-A-Journey-Down-the-Malay-Penninsula-by-Peter-Jenkins.pdf
    • http://loaminoo.linkpc.net/4090092098096090/Oracle-Bones-A-Journey-Through-Time-in-China-by-Peter-Hessler.pdf
    • http://loaminoo.linkpc.net/3094094091094091/Unquiet-Souls-A-Social-History-of-the-Illustrious-Irreverent-Intimate-Group-of-British-Aristocrats-Known-as-quot-The-Souls-quot-by-Angela-Lambert.pdf
    • http://loaminoo.linkpc.net/2095095091097090/Dreaming-in-Turtle-A-Journey-Through-the-Passion-Profit-and-Peril-of-Our-Most-Coveted-Prehistoric-Creatures-by-Peter-Laufer.pdf
    • http://loaminoo.linkpc.net/7099093090096097/Richelieu-and-His-Age-by-Carl-J-Burchard.pdf
    • http://loaminoo.linkpc.net/7099092098097095/Richelieu-by-Richard-Lodge.pdf
    • http://loaminoo.linkpc.net/7099092099095098/The-Rise-of-Richelieu-by-Joseph-Bergin.pdf
    • http://loaminoo.linkpc.net/7099092098096095/Richelieu-and-the-French-Monarchy-by-C-V-Wedgwood.pdf
    • http://loaminoo.linkpc.net/2090097092090096/Obsidian-So

Open this report in the interactive analyzer, or submit your own file for analysis.