Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcba88b53a00fcc5…

MALICIOUS

PDF

15.4 KB Created: 2019-04-30 05:30:38 +01:00 Authoring application: mPDF 5.7
MD5: 94f9ba0c5ab393ecc9be43acc3eb77e7 SHA-1: 1a31a3bcc51fd5950b79c6d71a95c6cb6444dd39 SHA-256: bcba88b53a00fcc56d97fbe484775c3a613e122c6424aabefd36c7c11a7cf62f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of embedded URLs, identified as a link farm. While the document body is heavily obfuscated, the presence of numerous links to external sites suggests a tactic to redirect users to potentially malicious content or for SEO manipulation. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7091093092093092/The-Wonderful-Wizard-of-Oz-By-L-Frank-Baum---Illustrated-Free-Audiobook-Unabridged-Original-E-Reader-Friendly-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5098098090096092/The-Wonderful-Wizard-of-Oz-By-L-Frank-Baum---Illustrated-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/9090095090099096/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5095092091096091/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/9099094094098097/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/6094090090095096/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5096097095096098/The-Wonderful-Wizard-of-Oz-Oz-1-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/8096097098098096/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/8099095090096/The-Wonderful-Wizard-of-Oz-Oz-1-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/4091090098099092/The-Wonderful-Wizard-Of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/2099096090093094/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/4091099090094093/The-Undead-World-of-Oz-L-Frank-Baum-s-the-Wonderful-Wizard-of-Oz-Complete-with-Zombies-and-Monsters-by-Ryan-C-Thomas.pdf
    • http://loaminoo.linkpc.net/1090093097097097094/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/1090095096097093094/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/9099099091095090/The-Wizard-Of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5092098093092097/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/6093094096096099/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/4091097091091090/Dorothy-and-the-Wizard-in-Oz-Oz-4-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5090091094093091/Dorothy-and-the-Wizard-in-Oz-Oz-4-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/8096094095099/Little-Wizard-Stories-of-Oz-by-L-Frank-Baum.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.