Malicious PDF — malware analysis report

Static analysis result for SHA-256 c077a7cdf42bd6c4…

MALICIOUS

PDF

15.2 KB Created: 2019-05-01 19:47:36 +01:00 Authoring application: mPDF 5.7
MD5: 566369dd89ae6da2b45c60069513fdaa SHA-1: ad7a32899fb19d9ef489e16276e99537d87698e5 SHA-256: c077a7cdf42bd6c499ad8678238b4bbff671488f03162b36c814931c2397748f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains a large number of embedded links to external PDFs hosted on the domain 'loaminoo.linkpc.net'. This heuristic firing suggests a link farm or a method to distribute further malicious content. The document body itself is heavily obfuscated, but the presence of numerous links to what appear to be book titles indicates a potential lure to download further content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2092098094094090/Switched-by-Jessica-Wollman.pdf
    • http://loaminoo.linkpc.net/9098095090092/Switched-Fear-Street-31-by-R-L-Stine.pdf
    • http://loaminoo.linkpc.net/6099090094097099/Switched-In-A-VR-Game-by-Jezabel-Foxx.pdf
    • http://loaminoo.linkpc.net/3099094091095091/I-m-with-Cupid-Switched-at-First-Kiss-1-by-Anna-Staniszewski.pdf
    • http://loaminoo.linkpc.net/1090096094096098/Hidden-Treasures-Switched-by-Shiloh-Sanders.pdf
    • http://loaminoo.linkpc.net/3094090095094099/The-Switched-Baby-Scandal-by-Theresa-Meyers.pdf
    • http://loaminoo.linkpc.net/2090097096096096/Switched-Trylle-Trilogy-1-by-Amanda-Hocking.pdf
    • http://loaminoo.linkpc.net/6099090095091099/Switched-amp-Stuffed-Gender-Swap-5-pack-by-Jezabel-Foxx.pdf
    • http://loaminoo.linkpc.net/9094098091091095/Driving-The-Uberverse-Diary-of-an-Uber-Driver-And-Why-I-Switched-to-LYFT-by-Raymond-Adam-Nadolny-Ph-D-.pdf
    • http://loaminoo.linkpc.net/2097099090096095/The-Complete-My-Sister-the-Vampire-Set-Books-1-4-Switched-Fangtastic-Re-Vamped-and-Vampalicious-4-Book-Set-by-Sienna-Mercer.pdf
    • http://loaminoo.linkpc.net/5091094092095/Going-Down-Wish-Upon-A-Stud-1-by-Elise-Sax.pdf
    • http://loaminoo.linkpc.net/4092095090099093/Just-The-Way-You-Are-by-Elise-Title.pdf
    • http://loaminoo.linkpc.net/4091096092095091/The-Other-Alcott-by-Elise-Hooper.pdf
    • http://loaminoo.linkpc.net/9095099096092097/Grub-by-Elise-Blackwell.pdf
    • http://loaminoo.linkpc.net/1098090097097091/Populazzi-by-Elise-Allen.pdf
    • http://loaminoo.linkpc.net/1090097099094098096/Pests-by-Elise-Primavera.pdf
    • http://loaminoo.linkpc.net/1091095096099099095/Just-Sacked-Wish-Upon-A-Stud-4-by-Elise-Sax.pdf
    • http://loaminoo.linkpc.net/1093093091099/Masterpiece-by-Elise-Broach.pdf
    • http://loaminoo.linkpc.net/3095092090094090/The-Madonna-of-the-Mountains-by-Elise-Valmorbida.pdf
    • http://loaminoo.linkpc.net/7094099096099/The-Night-Garden-by-Elise-Hurst.pdf
    • http://loaminoo.linkpc.net/2097099090096095/The-Complete-My-Sister-the-Vampire-Set-Book

Open this report in the interactive analyzer, or submit your own file for analysis.