Malicious PDF — malware analysis report

Static analysis result for SHA-256 a310b1303a19c995…

MALICIOUS

PDF

33.2 KB Created: 2019-04-30 02:00:02 +01:00 Authoring application: mPDF 5.7
MD5: 3e964788e44ce67d72381e5f564f9de3 SHA-1: d14e30aa8aeabb5b82bd4f282d6ccee1950b6962 SHA-256: a310b1303a19c995a136ce5718431cfc0e423b91b504f3fbc1506caaa6e8a671
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign-looking PDFs, the sheer volume and the use of a dynamic DNS hostname (linkpc.net) suggest a malicious intent, possibly for SEO spam or to distribute further malware. The document body contains numerous instances of the URL http://xiixmcuin.linkpc.net/1209206205209208/Mort-in-China-Comic-Issue-1-Funny-Chinese-Indie-Comic-Book-For-Kids-Teens-Adults-Short-Read-Understanding-Modern-China-and-Chinese-Culture-Through-Comics-Final-Destinations-by-Vali-Morrison.pdf, indicating this is a primary target for redirection.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/1209206205209208/Mort-in-China-Comic-Issue-1-Funny-Chinese-Indie-Comic-Book-For-Kids-Teens-Adults-Short-Read-Understanding-Modern-China-and-Chinese-Culture-Through-Comics-Final-Destinations-by-Vali-Morrison.pdf
    • http://xiixmcuin.linkpc.net/9204208202200201/Chinese-Short-Stories-by-Revolutionary-Authors---Read-Chinese-Literature-with-Detailed-Footnotes-Pinyin-Summaries-and-Audio-by-Kevin-John-Nadolny.pdf
    • http://xiixmcuin.linkpc.net/2201201200204200/Chinese-Whispers-China-Thrillers-6-by-Peter-May.pdf
    • http://xiixmcuin.linkpc.net/3200203202201206/China-Ink-The-Changing-Face-of-Chinese-Journalism-by-Judy-Polumbaum.pdf
    • http://xiixmcuin.linkpc.net/3201205205200206/A-Game-of-Thrones-Comic-Book-Issue-3-by-Daniel-Abraham.pdf
    • http://xiixmcuin.linkpc.net/5203208208203207/Papers-from-a-Viceroy-s-Yamen-A-Chinese-Plea-for-the-Cause-of-Good-Government-and-True-Civilization-in-China-by-Hongming-Gu.pdf
    • http://xiixmcuin.linkpc.net/1209206208204205/The-Chinese-Sultanate-Islam-Ethnicity-and-the-Panthay-Rebellion-in-Southwest-China-1856-1873-by-David-Atwill.pdf
    • http://xiixmcuin.linkpc.net/5203208208203204/Papers-From-a-Viceroy-s-Yamen-A-Chinese-Plea-for-the-Cause-of-Good-Government-and-True-Civilization-in-China-1901-by-Hongming-Gu.pdf
    • http://xiixmcuin.linkpc.net/5203208208203205/Papers-from-a-Viceroy-s-Yamen-A-Chinese-Plea-for-the-Cause-of-Good-Government-and-True-Civilization-in-China-by-Hung-ming-Ku.pdf
    • http://xiixmcuin.linkpc.net/5203208208203203/Papers-from-a-Viceroy-s-Yamen-A-Chinese-Plea-for-the-Cause-of-Good-Government-and-True-Civilization-in-China-by-Ku-Hung-Ming.pdf
    • http://xiixmcuin.linkpc.net/1200208206200201202/Funny-Not-Funny-A-Modest-Selection-Of-Comic-Art-Exhibiting-Signs-Of-Black-Humor-by-Ivan-Brunetti.pdf
    • http://xiixmcuin.linkpc.net/3201203207200208/Stories-For-Kids-amp-Teens-Includes-16-Original-Stories-with-Covers-Funny-Kids-Stories-Childrens-Book-Bundle-Animals-Character-Building-Lessons-by-Betty-J-Byers.pdf
    • http://xiixmcuin.linkpc.net/1209206207201201/The-Book-of-Chinese-Beliefs-A-Journey-Into-the-Chinese-Inner-World-by-Frena-Bloomfield.pdf
    • http://xiixmcuin.linkpc.net/7200200200204206/Articles-on-Comic-Book-Sidekicks-Including-Huey-Dewey-and-Louie-Obelix-Robin-Comics-Jughead-Jones-Speedy-Comics-J-Wellington-Wimpy-Jimmy-Olsen-Harley-Quinn-Dick-Grayson-Krypto-Kato-the-Green-Hornet-Pete-Ross-by-Hephaestus-Books.pdf
    • http://xiixmcuin.linkpc.net/6205204206207/Up-Up-and-Oy-Vey-How-Jewish-History-Culture-and-Values-Shaped-the-Comic-Book-Superhero-by-Simcha-Weinstein.pdf
    • http://xiixmcuin.linkpc.net/3206200205207202/Up-Up-and-Oy-Vey-How-Jewish-History-Culture-and-Values-Shaped-the-Comic-Book-Superhero-by-Simcha-Weinstein.pdf
    • http://xiixmcuin.linkpc.net/7209207202208202/Chinese-and-English-Phrase-Book-with-the-Chinese-Pronunciation-Indicated-in-English---Scholar-s-Choice-Edition-by-Benoni-Lanctot.pdf
    • http://xiixmcuin.linkpc.net/1200206202207201201/The-Comic-Toolbox-How-to-Be-Funny-Even-If-You-re-Not-by-John-Vorhaus.pdf
    • http://xiixmcuin.linkpc.net/7209207203201206/Chinese-and-English-Phrase-Book-with-the-Chinese-Pronunciation-Indicated-in-English-by-Benoni-Lanctot.pdf
    • http://xiixmcuin.linkpc.net/3201202207200203/Great-Stories-for-Young-Kids-13-Easy-to-Read-Short-Stories-That-Parents-and-Kids-can-Read-Together-by-Betty-J-Byers.pdf
    • http://xiixmcuin.linkpc.net/3200203202201206/China-Ink-The-C

Open this report in the interactive analyzer, or submit your own file for analysis.