Malicious PDF — malware analysis report

Static analysis result for SHA-256 c33ccf0855670b30…

MALICIOUS

PDF

15.0 KB Created: 2019-04-30 17:43:02 +01:00 Authoring application: mPDF 5.7
MD5: 431710edee420dceee9426723389a0f6 SHA-1: bec9c60b293589c7c75a94549ed0efa05bb91af5 SHA-256: c33ccf0855670b303f35cc5fa0c2c4a650aeea6bde73e69c1e1e7650e59cf7ba
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on the domain 'loaminoo.linkpc.net'. This is indicative of a link farm or a distribution mechanism for further malicious content. While the document body is heavily corrupted, the presence of numerous external links strongly suggests a malicious intent, likely related to SEO manipulation or malware distribution. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091094098096092099/Rivers-of-Babylon-Rivers-of-Babylon-1-by-Peter-Pi-anek.pdf
    • http://loaminoo.linkpc.net/5091092097098099/Canoeing-Michigan-Rivers-A-Comprehensive-Guide-to-45-Rivers-by-Jerry-Dennis.pdf
    • http://loaminoo.linkpc.net/3093094096092093/Joan-Rivers-Confidential-The-Unseen-Scrapbooks-Joke-Cards-Personal-Files-and-Photos-of-a-Very-Funny-Woman-Who-Kept-Everything-by-Melissa-Rivers.pdf
    • http://loaminoo.linkpc.net/8098096096097092/Works-of-William-Halse-Rivers-by-W-H-R-Rivers.pdf
    • http://loaminoo.linkpc.net/1093093096099092/Mason-s-War-A-Purge-of-Babylon-Story-Purge-of-Babylon-9-1-by-Sam-Sisavath.pdf
    • http://loaminoo.linkpc.net/1096094097090094/Out-of-the-Darkness-Babylon-5-Legions-of-Fire-3-by-Peter-David.pdf
    • http://loaminoo.linkpc.net/3093094090095/Alas-Babylon-by-Pat-Frank.pdf
    • http://loaminoo.linkpc.net/2094099093099/Tower-of-Babylon-by-Ted-Chiang.pdf
    • http://loaminoo.linkpc.net/1098090095098097/Alas-Babylon-by-Pat-Frank.pdf
    • http://loaminoo.linkpc.net/1091093097093099091/Tokyo-Babylon-Vol-4-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/2097096097092097/Tokyo-Babylon-Vol-1-by-CLAMP.pdf
    • http://loaminoo.linkpc.net/9090091095090095/How-Many-Miles-To-Babylon-by-Doris-Gercke.pdf
    • http://loaminoo.linkpc.net/4093096097098095/Wide-Eyed-in-Babylon-by-Ray-Milland.pdf
    • http://loaminoo.linkpc.net/3093098091099/The-Richest-Man-in-Babylon-by-George-S-Clason.pdf
    • http://loaminoo.linkpc.net/1098098093091094/The-Keys-of-Babylon-by-Robert-Minhinnick.pdf
    • http://loaminoo.linkpc.net/3098098098093092/The-Babylon-Hoard-by-Sean-MacCotter.pdf
    • http://loaminoo.linkpc.net/3098094092094093/The-Ghosts-of-Babylon-by-Jonathan-Baxter.pdf
    • http://loaminoo.linkpc.net/4095096094093095/Without-Mercy-Babylon-MC-2-by-Victoria-L-James.pdf
    • http://loaminoo.linkpc.net/5092090097097097/Breakfast-in-Babylon-by-Emer-Martin.pdf
    • http://loaminoo.linkpc.net/1091093097093099092/Star-of-Babylon-by-Barbara-Wood.pdf
    • http://loaminoo.linkpc.net

Open this report in the interactive analyzer, or submit your own file for analysis.