Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1739293c5904c2d…

MALICIOUS

PDF

15.4 KB Created: 2019-04-30 18:06:48 +01:00 Authoring application: mPDF 5.7
MD5: 40724d141d82824a2a95e2425e1997c4 SHA-1: 7f86ee08e32f8526d43bcbb2beab2ed7904f3035 SHA-256: c1739293c5904c2da57aae79ff233c63421d4fc2158c52aa9997d56818d9b5ee
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which are likely intended to direct users to malicious websites. While the document body is heavily obfuscated, the presence of numerous external links suggests a social engineering tactic to drive traffic to potentially harmful content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7091093092093092/The-Wonderful-Wizard-of-Oz-By-L-Frank-Baum---Illustrated-Free-Audiobook-Unabridged-Original-E-Reader-Friendly-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5098098090096092/The-Wonderful-Wizard-of-Oz-By-L-Frank-Baum---Illustrated-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/9090095090099096/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5095092091096091/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/9099094094098097/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/6094090090095096/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5096097095096098/The-Wonderful-Wizard-of-Oz-Oz-1-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/8096097098098096/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/8099095090096/The-Wonderful-Wizard-of-Oz-Oz-1-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/4091090098099092/The-Wonderful-Wizard-Of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/2099096090093094/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/4091099090094093/The-Undead-World-of-Oz-L-Frank-Baum-s-the-Wonderful-Wizard-of-Oz-Complete-with-Zombies-and-Monsters-by-Ryan-C-Thomas.pdf
    • http://loaminoo.linkpc.net/1090093097097097094/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/1090095096097093094/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/9099099091095090/The-Wizard-Of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5092098093092097/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/6093094096096099/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/4091097091091090/Dorothy-and-the-Wizard-in-Oz-Oz-4-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/5090091094093091/Dorothy-and-the-Wizard-in-Oz-Oz-4-by-L-Frank-Baum.pdf
    • http://loaminoo.linkpc.net/8096094095099/Little-Wizard-Stories-of-Oz-by-L-Frank-Baum.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.