Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3586770c3b5494d…

MALICIOUS

PDF

19.2 KB Created: 2019-05-01 23:15:09 +01:00 Authoring application: mPDF 5.7
MD5: 62a97aa1078b014d322d14a7efbc0194 SHA-1: e96da36e76ce4c7a7e351edf48cd5ce086af797a SHA-256: c3586770c3b5494df4ab9f1b2f49233b04b9ae4f071fc2fd83bb8c6524dec35d
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links are presented in a way that suggests they lead to book downloads, but their sheer volume and the domain used indicate a link farm or redirection scheme. The embedded URLs are likely intended to drive traffic to malicious or ad-filled sites, rather than providing actual content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7094098095095091/Dune-Book-Series-Legends-Of-Dune-Dune-Short-Stories-Heroes-Of-Dune-Prelude-To-Dune-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/7094098095094099/Dune-Novels-Book-Guide-Dune-Heretics-of-Dune-Children-of-Dune-Chapterhouse-Dune-God-Emperor-of-Dune-Dune-Messiah-Sandworms-of-Dune-by-Source-Wikipedia.pdf
    • http://loaminoo.linkpc.net/7094098097090091/Articles-on-Novels-by-Frank-Herbert-Including-Children-of-Dune-Chapterhouse-Dune-Dune-Messiah-God-Emperor-of-Dune-Heretics-of-Dune-Dune-Novel-the-Dragon-in-the-Sea-Destination-Void-Whipping-Star-the-Dosadi-Experiment-by-Hephaestus-Books.pdf
    • http://loaminoo.linkpc.net/2096096090096098/The-Winds-Of-Dune-Heroes-of-Dune-2-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/3095096096098092/Paul-Of-Dune-Heroes-of-Dune-1-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/7094098094097090/Dune-Red-Plague-A-Tale-of-the-Schools-of-Dune-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/2094099098099095/Mentats-of-Dune-Schools-of-Dune-2-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/8098091094092/Hunters-of-Dune-Dune-Chronicles-7-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/1092094096091091/Hunters-Of-Dune-Dune-Chronicles-7-by-Brian-Herbert.pdf
    • http://loaminoo.linkpc.net/7094098095094091/Dune-The-Gateway-Collection-Dune-Chronicles-1-6-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3093099091097/God-Emperor-of-Dune-Dune-Chronicles-4-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3098091092091095/Children-of-Dune-Dune-Chronicles-3-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/5092097092099/God-Emperor-of-Dune-Dune-Chronicles-4-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3096098098090/Chapterhouse-Dune-Dune-Chronicles-6-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3094091096092098/Children-of-Dune-Dune-Chronicles-3-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3093099098098/Dune-Messiah-Dune-Chronicles-2-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/4090095099094099/God-Emperor-of-Dune-Dune-Chronicles-4-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/3092092099090093/God-Emperor-of-Dune-Dune-Chronicles-4-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/2092092093091091/Dune-Dune-Chronicles-1-by-Frank-Herbert.pdf
    • http://loaminoo.linkpc.net/7090097090098/Dune-Dune-Chronicles-1-by-Frank-Herbert.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.