Malicious PDF — malware analysis report

Static analysis result for SHA-256 c498c6ec9f9313c4…

MALICIOUS

PDF

17.1 KB Created: 2019-04-24 18:05:36 +01:00 Authoring application: mPDF 5.7
MD5: 3c95887fd8e72b917b14ff4cbd78083e SHA-1: e2fe10f7ce7eb162f8dcdf363ad00e14cf015eb0 SHA-256: c498c6ec9f9313c4b50075c77f629b9a9289f262596e5df237a6682ce79d6fa6
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to a single domain, loaminoo.linkpc.net. This behavior is indicative of a link farm or a mechanism to distribute malicious content indirectly. The heuristic PDF_SEO_LINK_FARM specifically flags this pattern, suggesting an attempt to obscure the true malicious intent by linking to numerous other PDF files. The URLs themselves appear to be obfuscated or encoded, further raising suspicion.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091092092098091093/binibonnhonpo-sayuri-syasinsyuu-vol1-binibonhonpo-syasinsyuu-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/1090090092095092092/oubosokudoriHkei-michiko-syasinsyuu-vol2-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/1091092092095099093/dutch-wife-sayuri-syasinsyuu-vol2-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/1091092092095099091/dutch-wife-sayuri-syasinsyuu-vol1-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/1090095095099098095/marutto-marica-syasinsyuu-vol7-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/6096098095095095/suggokukaradanoEkochan-hiromi-syasinsyuu-vol1-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/5096093093097095/suggokukaradanoEkochan-remi-syasinsyuu-vol3-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/1091092092095098093/Sayuri-s-Food-for-Yogis-and-Everyone-Easy-delicious-healthy-vegan-recipes-with-gluten-free-alternatives-which-Sayuri-prepares-at-yoga-retreats-around-and-detox-Sayuri-s-Vegan-cookbook-Book-1-by-Sayuri-Tanaka.pdf
    • http://loaminoo.linkpc.net/1091092092095091091/Sayuri-s-Food-for-Yogis-and-Everyone-by-Tanaka-Sayuri.pdf
    • http://loaminoo.linkpc.net/1091092092097091094/Loving-the-Enemy-by-Kira-Sayuri.pdf
    • http://loaminoo.linkpc.net/8094098094097093/The-Cage-of-Zeus-by-Sayuri-Ueda.pdf
    • http://loaminoo.linkpc.net/1091092092094097091/BECAUSE-I-M-A-MAID-Episode-4-by-Sayuri-Sakai.pdf
    • http://loaminoo.linkpc.net/1091092092095091094/Sayuri-s-Theme-And-End-Credits-by-John-Williams.pdf
    • http://loaminoo.linkpc.net/1091092092098091092/Otome-no-nitijou-Tokiwa-Sayuri-Lite-003-by-HoneyRabbit.pdf
    • http://loaminoo.linkpc.net/1091092092098092090/Otome-no-nitijou-Tokiwa-Sayuri-Lite-002-by-HoneyRabbit.pdf
    • http://loaminoo.linkpc.net/1091092092098092097/PARCE-QUE-JE-SUIS-FEMME-DE-M-NAGE-Chapitre-3-by-Sayuri-Sakai.pdf
    • http://loaminoo.linkpc.net/1091092092098092093/Chiisana-Kuni-No-kina-Kiseki-Ky-bajin-Ga-Kokoro-Yutaka-Ni-Kurasu-Riy-by-Sayuri-Yoshida.pdf
    • http://loaminoo.linkpc.net/7091092098099090/kamijyou-tsukasa-tsukasa-no-karada-vol3-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/9091096098091092/mutou-tsugumi-tsugumi-no-karada-vol1-by-NOSTYLE.pdf
    • http://loaminoo.linkpc.net/7091092098099092/kamijyou-tsukasa-tsukasa-no-karada-vol1-by-NOSTYLE.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.