Malicious PDF — malware analysis report

Static analysis result for SHA-256 b864bedf96cdc6b7…

MALICIOUS

PDF

16.3 KB Created: 2019-05-02 16:44:25 +01:00 Authoring application: mPDF 5.7
MD5: 608b2d3f23cb90f367c85345c59a8e12 SHA-1: 3601b01320659926fc9bd80928235bfe0d3086b4 SHA-256: b864bedf96cdc6b772c0d7b6b03407b5c83ac727339a336fbca99e83416e0fdc
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently flagged as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6097093097093/Orphan-at-My-Door-The-Home-Child-Diary-of-Victoria-Cope-by-Jean-Little.pdf
    • http://loaminoo.linkpc.net/1091099090096092097/Thursday-s-Child-by-Victoria-Poole.pdf
    • http://loaminoo.linkpc.net/1096096097093092/Diary-of-the-mad-A-short-story-collection-by-Victoria-Haugnes.pdf
    • http://loaminoo.linkpc.net/2095093091096091/The-Ninth-Orphan-The-Orphan-Trilogy-1-by-James-Morcan.pdf
    • http://loaminoo.linkpc.net/2095093091096098/The-Orphan-Uprising-The-Orphan-Trilogy-3-by-James-Morcan.pdf
    • http://loaminoo.linkpc.net/2095093094095092/The-Orphan-Factory-The-Orphan-Trilogy-2-by-James-Morcan.pdf
    • http://loaminoo.linkpc.net/7093096091090091/Diary-of-a-Child-Called-Souad-by-Nawal-El-Saadawi.pdf
    • http://loaminoo.linkpc.net/1096092093095094/Narcissistic-Lovers-How-to-Cope-Recover-and-Move-On-How-to-Cope-Recover-and-Move-on-by-Cynthia-Zayn.pdf
    • http://loaminoo.linkpc.net/4098096098095098/Through-the-Eyes-of-a-Child-Diary-of-an-Eleven-Year-Old-Jewish-Girl-by-Ilse-Reiner.pdf
    • http://loaminoo.linkpc.net/5091092099091098/When-Madness-Comes-Home-Help-and-Hope-for-Families-of-the-Mentally-Ill-by-Victoria-Secunda.pdf
    • http://loaminoo.linkpc.net/4092093091096091/Home-to-My-Father-A-Knight-s-Diary-by-Mary-C-Findley.pdf
    • http://loaminoo.linkpc.net/5092099094098094/Opium-The-Diary-of-His-Cure-by-Jean-Cocteau.pdf
    • http://loaminoo.linkpc.net/2094091092/Orphan-X-Orphan-X-1-by-Gregg-Hurwitz.pdf
    • http://loaminoo.linkpc.net/1095093090098091/The-Captive-of-Kensington-Palace-Queen-Victoria-1-by-Jean-Plaidy.pdf
    • http://loaminoo.linkpc.net/1098093099092095/Calling-Home-Destiny-s-Child-1-by-Zee-Monodee.pdf
    • http://loaminoo.linkpc.net/7099096095097092/The-Immortal-Child-by-Jean-Hudon.pdf
    • http://loaminoo.linkpc.net/4097094095094092/The-Psychology-of-the-Child-by-Jean-Piaget.pdf
    • http://loaminoo.linkpc.net/1098098096097/Diary-of-a-Mad-Househusband-Musings-on-Life-as-a-Stay-At-Home-Dad-by-Joseph-Oberle.pdf
    • http://loaminoo.linkpc.net/4098097094091095/Home-from-Far-by-Jean-Little.pdf
    • http://loaminoo.linkpc.net/5096096090091098/Aurore-the-Child-Martyr-by-Leon-Petit-Jean.pdf
    • http://loaminoo.linkpc.net/5091092099091098/When-Madness-Comes-H

Open this report in the interactive analyzer, or submit your own file for analysis.