Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2705c12c98faca0…

MALICIOUS

PDF

14.9 KB Created: 2019-05-07 04:41:13 +01:00 Authoring application: mPDF 5.7
MD5: 7649a59f11d5d4de2989363b72191253 SHA-1: 0c71c79e43e24c0bc449b8ea904b12fb34a42abe SHA-256: b2705c12c98faca027aff84049b82c1231019f78918fd1cd96a790c86ef8c2af
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various documents hosted on loaminoo.linkpc.net. While the individual URLs are marked as confirmed benign, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or as a distribution vector for other malware. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo
    • http://loaminoo.linkpc.net/1091098093092095096/eigakamataki-kanzaki-shiho-documentary-satuei-urabanasi-to-esokanchi-by-Shiho-Kanzaki.pdf
    • http://loaminoo.linkpc.net/1090099093090091095/Samurai-Revolution-The-Dawn-of-Modern-Japan-Seen-Through-the-Eyes-of-the-Shogun-s-Last-Samurai-by-Romulus-Hillsborough.pdf
    • http://loaminoo.linkpc.net/1091097097098092/Samurai-Awakening-Samurai-Awakening-1-by-Benjamin-Martin.pdf
    • http://loaminoo.linkpc.net/1091098093091098093/Tsukasa-Kanzaki-GIRL-B-by-G-Publishers.pdf
    • http://loaminoo.linkpc.net/1091098093091098092/Tsukasa-Kanzaki-GIRL-C-by-G-Publishers.pdf
    • http://loaminoo.linkpc.net/1091098093091098091/KANZAKI-KANAE-PHOTOBOOK-2009-by-SEIJIN.pdf
    • http://loaminoo.linkpc.net/1091095097093097093/--Black-Bullet-5-by-Shiden-Kanzaki.pdf
    • http://loaminoo.linkpc.net/1091098093091098098/KANZAKI-KANAE-PORTRAIT-PHOTOGRAPHY-SHUUYOU-by-SEIJIN.pdf
    • http://loaminoo.linkpc.net/1091098093094097099/Semantikku-Webu-No-Tameno-rud-efu-ru-Ny-mon-by-Masahide-Kanzaki.pdf
    • http://loaminoo.linkpc.net/1091098093091099095/Xenon-Volume-1-Heavy-Metal-Warrior-by-Masaomi-Kanzaki.pdf
    • http://loaminoo.linkpc.net/1091098093093092099/Encounters-with-Fire-Encounters-with-People-by-Shiho-Kanzaki.pdf
    • http://loaminoo.linkpc.net/5096094096093091/Oakdale-Confidential-by-Anonymous.pdf
    • http://loaminoo.linkpc.net/3097092098098098/Samurai-Jack-Vol-1-by-Jim-Zub.pdf
    • http://loaminoo.linkpc.net/5096094097094098/Art-School-Confidential-by-Daniel-Clowes.pdf
    • http://loaminoo.linkpc.net/5096094097094095/Confidential-Expecting-by-Jackie-Braun.pdf
    • http://loaminoo.linkpc.net/5096094094098098/Belfast-Confidential-by-Colin-Bateman.pdf
    • http://loaminoo.linkpc.net/5096094095095090/Mocha-Confidential-by-Billy-McCoy.pdf
    • http://loaminoo.linkpc.net/3097097099093098/Thornbury-Confidential-by-Beth-Lyons.pdf
    • http://loaminoo.linkpc.net/1092097091093098/Senseless-Confidential-by-Martin-Bannon.pdf
    • http://loaminoo.linkpc.net/6092093091090/Way-Of-The-Samurai-by-Yukio-Mishima.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.