Malicious PDF — malware analysis report

Static analysis result for SHA-256 c35bbcb811b09ad9…

MALICIOUS

PDF

13.5 KB Created: 2019-05-06 16:29:21 +01:00 Authoring application: mPDF 5.7
MD5: 59fa42e140de0cdcbdd48e044fe8c918 SHA-1: 8ac6f1068eb3f3839ea42cce48833ef2bd97d682 SHA-256: c35bbcb811b09ad95fb27bd5d06a55f131d44fb345fffb17a9fa482aa38f53a0
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded external links, forming a link farm. The primary heuristic indicates this is a critical finding, suggesting the document's purpose is to direct users to a multitude of external resources. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the exact user-facing lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5098090098092/How-to-Freedive-A-beginners-guide-to-apnea-diving-How-to-reach-100-feet-on-one-breath-A-guide-to-the-art-and-science-of-breath-hold-freediving-by-Eduardo-Marchese.pdf
    • http://loaminoo.linkpc.net/1097093098094094/Eternal-Breath-of-Darkness-Breath-of-Darkness-1-by-Candice-Stauffer.pdf
    • http://loaminoo.linkpc.net/1097097092091092/Stealing-Breath-Stealing-Breath-1-by-Joanne-Brothwell.pdf
    • http://loaminoo.linkpc.net/6094091094091/Blueback-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/5093091099096/Cloudstreet-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/1099091098090090/Minimum-of-Two-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/3095090094095098/The-Riders-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/6093093092095/Cloudstreet-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/1090092092092096/The-Turning-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/2099097090093098/Beyond-Nostalgia-by-Tom-Winton.pdf
    • http://loaminoo.linkpc.net/9093095095099/The-Last-American-Martyr-by-Tom-Winton.pdf
    • http://loaminoo.linkpc.net/1099091097096093/In-the-Winter-Dark-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/8096094094095090/Schwindel-Roman-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/5092090092090093/An-Open-Swimmer-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/8096090091093094/Das-Haus-an-der-Cloudstreet-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/3092092096093098/Land-s-Edge-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/3095098090091/Dirt-Music-by-Tim-Winton.pdf
    • http://loaminoo.linkpc.net/1090098095097095/The-Golden-Horn-by-June-Winton.pdf
    • http://loaminoo.linkpc.net/3091091098096090/The-Stolen-Christmas-by-June-Winton.pdf
    • http://loaminoo.linkpc.net/4098091090090095/Journey-Into-Darkness-by-Winton-Higgins.pdf
    • http://loaminoo.linkpc.net/1090092092092096/The

Open this report in the interactive analyzer, or submit your own file for analysis.