Malicious PDF — malware analysis report

Static analysis result for SHA-256 b73d1cbaa1eb0f16…

MALICIOUS

PDF

20.6 KB Created: 2019-04-30 02:33:13 +01:00 Authoring application: mPDF 5.7
MD5: 7caa6a66b36a6abec29008bc4c240faa SHA-1: 1ac469f4b234ad0113514bc5b9c0ebe5aedc3f0f SHA-256: b73d1cbaa1eb0f160b902c1454041b6170c3f74bb4e2053fca0c2692e52d5961
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDFs, a technique often used for SEO manipulation or to distribute malicious content. The heuristic PDF_SEO_LINK_FARM specifically flags this behavior. While the URLs themselves are currently marked as benign, the sheer volume and the suspicious domain suggest a potential distribution or redirection mechanism. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7096094091091095/Antolog-a-Po-tica-Bardo-Inquieto-by-Manuel-Antonio-Gonz-lez-Cabrera.pdf
    • http://loaminoo.linkpc.net/9097090090092093/Huehuetlapallan-Amerika-s-Grosse-Urstadt-in-Dem-K-nigreiche-Guatimala-Neu-Entdeckt-Von-Capit-Don-Antonio-del-Rio-Und-ALS-Eine-Ph-nicisch-Canan-ische-Und-Carthagische-Pflanzstade-Erwiesen-in-Neu-Guatimala-Nebst-Siebzehn-Grossen-Zeichnungen-in-Stein-by-Paul-Felix-Cabrera.pdf
    • http://loaminoo.linkpc.net/9097090090092092/Huehuetlapallan-Amerika-s-Grosse-Urstadt-in-Dem-K-nigreiche-Guatimala-Neu-Entdeckt-Von-Capit-Don-Antonio-del-Rio-Und-ALS-Eine-Ph-nicisch-Canan-ische-Und-Carthagische-Pflanzstade-Erwiesen-in-Neu-Guatimala-Nebst-Siebzehn-Grossen-Zeichnungen-in-Stein-by-Paul-Felix-Cabrera.pdf
    • http://loaminoo.linkpc.net/5092091094097098/Bardo-or-Not-Bardo-by-Antoine-Volodine.pdf
    • http://loaminoo.linkpc.net/6091090097096091/Poes-a-Vertical-Antolog-a-by-Roberto-Juarroz.pdf
    • http://loaminoo.linkpc.net/1091091093090093098/Answer-Key-for-Manual-de-Gram-tica-Y-Ortograf-a-Para-Hispanos-by-Mar-a-Elena-Franc-s.pdf
    • http://loaminoo.linkpc.net/9094090096093098/L-uomo-inquieto-L-ultima-inchiesta-del-commissario-Wallander-by-Henning-Mankell.pdf
    • http://loaminoo.linkpc.net/6094091091092092/Meurs-pas-on-a-du-monde-San-Antonio-104-by-San-Antonio.pdf
    • http://loaminoo.linkpc.net/7096098093096097/Watch-Where-the-Wolf-Is-Going-Stories-by-Antonio-Skarmeta-by-Antonio-Sk-rmeta.pdf
    • http://loaminoo.linkpc.net/7096093097095092/Bardo-by-Suzanne-Paola.pdf
    • http://loaminoo.linkpc.net/7096093097095094/Bardo-by-Krandall-Kraus.pdf
    • http://loaminoo.linkpc.net/8094092094095094/Row-Row-Row-Your-Boat-by-Jane-Cabrera.pdf
    • http://loaminoo.linkpc.net/8094092095091096/Miguel-Cabrera-by-Jon-M-Fishman.pdf
    • http://loaminoo.linkpc.net/8094092094096090/The-Wheels-on-the-Bus-by-Jane-Cabrera.pdf
    • http://loaminoo.linkpc.net/7096094091090096/The-Masterpieces-of-the-Bardo-Museum-by-Miniguide.pdf
    • http://loaminoo.linkpc.net/2094094099099093/Lincoln-in-the-Bardo-by-George-Saunders.pdf
    • http://loaminoo.linkpc.net/7096093099090096/Babe-in-the-Bardo-by-Kelli-Ann-Brommel.pdf
    • http://loaminoo.linkpc.net/8094092095091095/One-Two-Buckle-My-Shoe-by-Jane-Cabrera.pdf
    • http://loaminoo.linkpc.net/8094092095091097/Mommy-Carry-Me-Please-by-Jane-Cabrera.pdf
    • http://loaminoo.linkpc.net/8094092094095096/Baa-Baa-Black-Sheep-by-Jane-Cabrera.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.