Malicious PDF — malware analysis report

Static analysis result for SHA-256 baa19880b7617298…

MALICIOUS

PDF

15.6 KB Created: 2019-05-07 04:22:10 +01:00 Authoring application: mPDF 5.7
MD5: 469d7bed47d3e87ecdf7a26b2bb5bcc5 SHA-1: 7094a75122dce9fbae66200c71343050fc539076 SHA-256: baa19880b76172988366236a12d3059b00779bc0813a40b2440da8646f09507e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are marked as benign, the sheer volume and structure suggest an attempt to manipulate search engine results or to serve as a distribution point for other malicious content. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific intent beyond the link farm heuristic.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1092094094094090/High-Cotton-Maafa-by-P-J-Dunn.pdf
    • http://loaminoo.linkpc.net/3098099091092090/High-Cotton-Bucklin-Family-Reunion-1-by-Debby-Mayne.pdf
    • http://loaminoo.linkpc.net/1090098097098092098/Jerry-Cotton-Sonder-Edition---Folge-001-Ein-teuflischer-Plan-by-Jerry-Cotton.pdf
    • http://loaminoo.linkpc.net/1090094090097097095/Jerry-Cotton---Folge-3005-Der-Tod-stellt-viele-Fragen-by-Jerry-Cotton.pdf
    • http://loaminoo.linkpc.net/1091094095099091092/Jerry-Cotton---Folge-2850-Liebe-ist-ein-hartes-Gesch-ft-by-Jerry-Cotton.pdf
    • http://loaminoo.linkpc.net/1090097091094094097/Jerry-Cotton---Folge-2958-Am-Ziel-wartet-der-Tod-by-Jerry-Cotton.pdf
    • http://loaminoo.linkpc.net/9092098091094091/Jerry-Cotton---Folge-2171-Das-L-cheln-der-Tigerin-by-Jerry-Cotton.pdf
    • http://loaminoo.linkpc.net/1090092090091095092/Jerry-Cotton---Folge-2908-Die-Fackel-der-Vergeltung-by-Jerry-Cotton.pdf
    • http://loaminoo.linkpc.net/1091091090096096098/Jerry-Cotton---Folge-2826-Bomben-in-Manhattan-by-Jerry-Cotton.pdf
    • http://loaminoo.linkpc.net/8099093097093091/Jerry-Cotton---Folge-2884-Im-Netz-der-Spinne-by-Jerry-Cotton.pdf
    • http://loaminoo.linkpc.net/3091090094098099/Gone-on-Sunday-A-Cotton-Lee-Penn-Historical-Mystery-Cotton-Lee-Penn-Historical-Mysteries-Book-1-by-Tower-Lowe.pdf
    • http://loaminoo.linkpc.net/5092098094096092/Danny-Dunn-and-the-Smallifying-Machine-Danny-Dunn-11-by-Jay-Williams.pdf
    • http://loaminoo.linkpc.net/5092098095090099/Danny-Dunn-Scientific-Detective-Danny-Dunn-14-by-Jay-Williams.pdf
    • http://loaminoo.linkpc.net/1094097095096097/Danny-Dunn-and-the-Homework-Machine-Danny-Dunn-3-by-Jay-Williams.pdf
    • http://loaminoo.linkpc.net/5092098095090096/Danny-Dunn-and-the-Heat-Ray-Danny-Dunn-7-by-Jay-Williams.pdf
    • http://loaminoo.linkpc.net/3093091095091093/Mistress-and-Commander-High-Jinks-High-Seas-and-Highlanders-by-Amelia-Dalton.pdf
    • http://loaminoo.linkpc.net/4093097097097094/All-s-Fair-in-Love-War-and-High-School-Pullman-High-2-by-Janette-Rallison.pdf
    • http://loaminoo.linkpc.net/1090099099096094094/High-Jinks-in-High-Places-by-Ruth-Barrett.pdf
    • http://loaminoo.linkpc.net/3097095093096090/The-Cotton-Pickers-by-B-Traven.pdf
    • http://loaminoo.linkpc.net/3095094096097092/Boundless-by-Brad-Cotton.pdf
    • http://loaminoo.linkpc.net/3091090094098099/Gone-on-Sunday-A-Cotton-Lee-Penn-Historical-Myster

Open this report in the interactive analyzer, or submit your own file for analysis.