Malicious PDF — malware analysis report

Static analysis result for SHA-256 a31355fc6e7c9d73…

MALICIOUS

PDF

12.5 KB Created: 2019-04-28 09:28:34 +01:00 Authoring application: mPDF 5.7
MD5: 75f127d34b4bc51097c1483ccf9ad2df SHA-1: 2ee7c83b0e292db12c4d4b1560adbfe00d4f6bae SHA-256: a31355fc6e7c9d73e22f16f19661ea74ec2930021e0c2af46c10e8fe40113e8b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to a domain that hosts what appear to be pirated books. This suggests a link farm or a lure to a site distributing potentially harmful content. The heuristic PDF_SEO_LINK_FARM specifically identifies this pattern, indicating the document's primary purpose is to drive traffic to these external URLs.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1098099099097/In-One-Person-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/3096092093092094/The-World-According-to-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1099090094099095/Das-Hotel-New-Hampshire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1098097092099090/The-Imaginary-Girlfriend-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1091099091091099092/Hotel-New-Hampshire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/4090091092095091/The-World-According-to-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/4090099096094/The-Fourth-Hand-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/3098091090091099/The-World-According-to-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/7093099097093091/Hotel-New-Hampshire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1098097092092097/The-Hotel-New-Hampshire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/9097099098093094/The-World-According-To-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/6091094096099094/En-b-n-f-r-Owen-Meany-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/2097092099094093/The-World-According-to-Garp-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/5098090097092093/Un-mariage-poids-moyen-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/4090091091093097/A-Prayer-for-Owen-Meany-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/7096091091099092/La-Petite-Amie-imaginaire-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1090097096097098097/My-Movie-Business-A-Memoir-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/1090097096096098098/Trying-to-Save-Piggy-Sneed-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/9093099090096092/En-b-nn-for-Owen-Meany-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/2098096090097094/The-Cider-House-Rules-by-John-Irving.pdf
    • http://loaminoo.linkpc.net/2097092099094093/The-World-According-to-Garp-by-John-Irving

Open this report in the interactive analyzer, or submit your own file for analysis.