Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae39532253463a05…

MALICIOUS

PDF

21.8 KB Created: 2019-04-30 02:53:34 +01:00 Authoring application: mPDF 5.7
MD5: 5b58d000618bd562c440445baaaba841 SHA-1: 187628bc3be1ec925f16c728eced5d7079de450b SHA-256: ae39532253463a05287a9d4c4266fe96bed1c6e3a6e135c260f60e92d905d8f2
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits a critical heuristic firing for a link farm, containing numerous external links. While the document body is heavily obfuscated, the presence of a large number of links suggests an attempt to manipulate search engine results or distribute further malicious content. The primary IOCs are the embedded URLs, which are likely used to host or redirect to malicious payloads.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.lin
    • http://loaminoo.linkpc.net/8094090094091095/Will-You-Still-Love-Me-by-Jean-Baptiste-Baronian.pdf
    • http://loaminoo.linkpc.net/8094090094098097/Dictionnaire-Rimbaud-by-Jean-Baptiste-Baronian.pdf
    • http://loaminoo.linkpc.net/7093099094099097/La-Litt-rature-fran-aise-Pour-les-Nuls-by-Jean-Joseph-Julaud.pdf
    • http://loaminoo.linkpc.net/5096091094096093/Introduction-la-litt-rature-fantastique-Po-tique-by-Tzvetan-Todorov.pdf
    • http://loaminoo.linkpc.net/6094092098092097/Eclats-d-insomnie-Litt-rature-Fran-aise-by-Diane-De-Margerie.pdf
    • http://loaminoo.linkpc.net/5099090094096090/Odette-Toulemonde-et-autres-histoires-Litt-rature-fran-aise-by-ric-Emmanuel-Schmitt.pdf
    • http://loaminoo.linkpc.net/7094094092096097/Du-Fanatisme-Dans-La-Langue-R-volutionnaire-Ou-de-la-Pers-cution-Suscit-e-Par-Les-Barbares-Du-Dix-Huiti-me-Si-cle-Contre-La-Religion-Chr-tienne-Et-Ses-Ministres-Par-Jean-Fran-ois-de-Laharpe-of-1-Volume-1-by-Jean-Fran-ois-de-la-Harpe.pdf
    • http://loaminoo.linkpc.net/8093091090095092/Association-Ou-Organisme-Lie-A-L-Education-Maison-Familiale-Rurale-Association-Canadienne-D-Education-de-Langue-Francaise-Parsec-Planete-Sciences-Les-Petits-Debrouillards-La-3e-Voie-Board-of-European-Students-of-Technology-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/8092095095095095/Bouche-cousue-by-Jean-Baptiste-Messier.pdf
    • http://loaminoo.linkpc.net/6096090090098095/Simon-Sabiani-by-Jean-Baptiste-Nicola-.pdf
    • http://loaminoo.linkpc.net/6095093091096090/Discours-Sur-L-Origine-Et-Les-Fondements-de-L-Inegalite-Parmi-Les-Hommes-Avec-La-Reine-Fantastique-by-Jean-Jacques-Rousseau.pdf
    • http://loaminoo.linkpc.net/6094099099096095/Le-Grand-Camee-de-France-by-Jean-Baptiste-Giard.pdf
    • http://loaminoo.linkpc.net/5095097098095096/Astrologia-Gallica-Books-13-14-15-19-by-Jean-Baptiste-Morin.pdf
    • http://loaminoo.linkpc.net/8094098091091092/L-on-XIII-Le-semeur-de-Dieu-by-Jean-Baptiste-No-.pdf
    • http://loaminoo.linkpc.net/8095098099096091/Tartuffe-or-the-Hypocrite-by-Jean-Baptiste-Poquelin-Moli-re.pdf
    • http://loaminoo.linkpc.net/7095090098095095/Valuation-of-Internet-Start-Ups-by-Jean-Baptiste-Flanc.pdf
    • http://loaminoo.linkpc.net/5095097097098099/Astrologia-Gallica-Book-16-by-Jean-Baptiste-Morin.pdf
    • http://loaminoo.linkpc.net/8094096097093096/Travels-in-India-2-Volume-Set-by-Jean-Baptiste-Tavernier.pdf
    • http://loaminoo.linkpc.net/5095097097098097/Astrologia-Gallica-Book-25-by-Jean-Baptiste-Morin.pdf
    • http://loaminoo.linkpc.net/5098099097091097/Aminata-ou-la-question-humaine-by-Jean-Baptiste-Messier.pdf