Malicious PDF — malware analysis report

Static analysis result for SHA-256 a402bb78fa75ce8f…

MALICIOUS

PDF

13.6 KB Created: 2019-05-02 07:02:50 +01:00 Authoring application: mPDF 5.7
MD5: 4b9e797a147c20b3306c9fc715a15c4e SHA-1: 99aa382e1314fa642272c690d89823b9cb72c22c SHA-256: a402bb78fa75ce8f53cc25e877f836b62de62685a13a2310f7c82eaa2261cdbf
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external URLs, a technique often used for SEO manipulation or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, with 'loaminoo.linkpc.net' being the dominant host. While the URLs themselves are marked as confirmed benign, the sheer volume and structure suggest a malicious intent to drive traffic or potentially distribute further payloads. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2091097096092099/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/7092091095098097/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/6091099091099090/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/6090092093097097/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/9095090099094095/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/7091093094098098/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/8095092099099099/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/8099091095096098/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/5090093099097099/The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/5096098099099091/El-Hombre-Invisible-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/1090094098093099098/Together-with-The-Invisible-Man-Class--XII-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/7097091093090096/The-Invisible-Man-Pre-Intermediate-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/8092097094093093/The-Invisible-Man---Class-12-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/3094094093093093/The-Time-Machine-The-Invisible-Man-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/5098096097092096/The-Invisible-Man-HCR104fm-Edition-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/8090093090093096/The-Invisible-Man-Color-Illustrated-Formatted-for-E-Readers-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/8090098090094096/The-Invisible-Man-Annotated-Student-and-Teacher-Edition-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/9098095093090095/The-Island-of-Doctor-Moreau-by-H-G-Wells-Illustrated-Delphi-Parts-Edition-H-G-Wells-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/5097099097099096/The-Time-Machine-By-H-G-Wells---Illustrated-Bonus-Free-Audiobook-by-H-G-Wells.pdf
    • http://loaminoo.linkpc.net/6095091098099098/The-Time-Machine-Herbert-George-Wells-by-H-G-Wells.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.