Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf0aa0bccc33a219…

MALICIOUS

PDF

13.9 KB Created: 2019-05-01 20:10:04 +01:00 Authoring application: mPDF 5.7
MD5: 4f17f21355750c057511975be5fffaa1 SHA-1: 520a092f947bdcf26c01e6c6747454baf763b1b1 SHA-256: bf0aa0bccc33a21967ff11ebcfea6c7577b530ff404d47bf0e35c698bfd6459f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various book titles hosted on loaminoo.linkpc.net. While the individual URLs are marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent, likely for SEO manipulation or to distribute further malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6090090093098095/The-Dragon-s-Captive-Dragon-Brides-2-by-Loki-Renard.pdf
    • http://loaminoo.linkpc.net/1094096093095090/Savage-s-Recruit-Military-Discipline-1-by-Loki-Renard.pdf
    • http://loaminoo.linkpc.net/5094090097098091/Ars-Erotica-Das-gro-e-Renard-Lesebuch-1000-Seiten-erotische-Unterhaltung-im-historischen-Gewand-by-Renard-Fourrure.pdf
    • http://loaminoo.linkpc.net/2090091093094095/Captive-at-Christmas-Captive-Hearts-1-by-Danielle-Taylor.pdf
    • http://loaminoo.linkpc.net/3094094090090097/From-Willing-Sub-To-Enslaved-Captive-Captive-s-1-by-Scarlett-Flame.pdf
    • http://loaminoo.linkpc.net/4095091097095099/The-Journal-of-Jules-Renard-by-Jules-Renard.pdf
    • http://loaminoo.linkpc.net/4090090099096094/Captive-Captive-1-by-Brighton-Walsh.pdf
    • http://loaminoo.linkpc.net/3092096095097092/The-Russian-s-Captive-Captive-2-by-C-M-Steele.pdf
    • http://loaminoo.linkpc.net/9093090094093095/Captive-to-the-Dark-Complete-Series-Captive-to-the-Dark-1-4-by-Alaska-Angelini.pdf
    • http://loaminoo.linkpc.net/4091097098097096/Captive-Prince-Volume-Two-Captive-Prince-2-by-C-S-Pacat.pdf
    • http://loaminoo.linkpc.net/2099093097096090/Captive-Prince-Volume-One-Captive-Prince-1-by-C-S-Pacat.pdf
    • http://loaminoo.linkpc.net/4094095097093/Captive-Prince-Volume-Two-Captive-Prince-2-by-C-S-Pacat.pdf
    • http://loaminoo.linkpc.net/1091090099092094093/Loki-by-Rob-M-Worley.pdf
    • http://loaminoo.linkpc.net/8091091096092091/The-Chef-by-Josee-Renard.pdf
    • http://loaminoo.linkpc.net/4096099091097/Loki-by-Mike-Vasich.pdf
    • http://loaminoo.linkpc.net/1091090099091092096/Loki-by-Robert-Rodi.pdf
    • http://loaminoo.linkpc.net/6094096091098092/Goer-Le-Renard-by-Michel-Jeury.pdf
    • http://loaminoo.linkpc.net/1091090099092093098/Loki-Agent-of-Asgard-12-by-Al-Ewing.pdf
    • http://loaminoo.linkpc.net/1091090099091098092/Loki-Agent-of-Asgard-7-by-Al-Ewing.pdf
    • http://loaminoo.linkpc.net/1091090099091093095/Loki-Agent-of-Asgard-3-by-Al-Ewing.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.