Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5d7e0f19ebf8f70…

MALICIOUS

PDF

15.0 KB Created: 2019-04-30 05:49:52 +01:00 Authoring application: mPDF 5.7
MD5: 5d7cdcfaf7ce6eb5502b2b06f0673d98 SHA-1: c8014bc87f085589a7b59e7a2f2c2e2f0b4ef7de SHA-256: b5d7e0f19ebf8f70a7b1e60148f4ed70c769adca7c1c3a6935b3e41937a42d76
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various book titles hosted on the 'loaminoo.linkpc.net' domain. While the URLs themselves are marked as benign, the sheer volume and the nature of the heuristic suggest a potential SEO manipulation or a distribution mechanism for further malicious content. No scripts were extracted, and the document body was unreadable, limiting the analysis of the specific intent beyond the link farm.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8098098093096096/That-Night-on-Thistle-Lane-Swift-River-Valley-2-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/8098098095093090/Red-Clover-Inn-Swift-River-Valley-7-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/2099090090097095/Christmas-at-Carriage-Hill-Swift-River-Valley-3-5-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/8098098094098093/The-Spring-at-Moss-Hill-Swift-River-Valley-6-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/2091097093098092/All-in-a-Name-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/4091099096095099/The-Waterfall-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/2092099096093098/The-Whisper-Ireland-Series-4-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/1091099091097/The-Angel-Ireland-Series-2-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/3091099092097092/The-Cabin-Carriage-House-2-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/4093094095091098/The-Widow-Ireland-Series-1-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/2097094092094096/Saint-s-Gate-Sharpe-amp-Donovan-1-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/3091099097094094/Abandon-Cold-Ridge-U-S-Marshals-6-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/7099097098097094/Thief-s-Mark-Sharpe-amp-Donovan-7-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/3099096092093097/Cold-Dawn-Black-Falls-3-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/2095096090091/Harbor-Island-Sharpe-amp-Donovan-4-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/1091091095096099095/Danella-Valley-Day-by-Day-by-Carla-Michelle.pdf
    • http://loaminoo.linkpc.net/1095090093094092/Swift-River-by-R-C-Binstock.pdf
    • http://loaminoo.linkpc.net/6095092098090092/A-Thistle-amp-Hive-Christmas-Thistle-amp-Hive-4-5-by-Jennae-Vale.pdf
    • http://loaminoo.linkpc.net/4093094092095090/The-Carriage-House-Carriage-House-1-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/6098094099098095/Meurtre-Heron-s-Cove-T1---S-rie-Emma-Sharpe-et-Colin-Donovan-Emma-Sharpe-amp-Colin-Donovan-by-Carla-Neggers.pdf
    • http://loaminoo.linkpc.net/2097094092094096/Saint-s-Gate-Sharp

Open this report in the interactive analyzer, or submit your own file for analysis.