Malicious PDF — malware analysis report

Static analysis result for SHA-256 c872fbc0535ca882…

MALICIOUS

PDF

15.2 KB Created: 2019-04-29 23:18:38 +01:00 Authoring application: mPDF 5.7
MD5: 81551e4440b10538c448d25c8dd2985e SHA-1: 58df0db4bb384245d3333620e699f59c11bc94ae SHA-256: c872fbc0535ca882f51ef215a57c25e63c1ca9bd6ee114b4319a174765f9de6e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links predominantly point to the 'loaminoo.linkpc.net' domain and appear to be related to book titles, suggesting a potential SEO manipulation or a distribution mechanism for further malicious content. No scripts were extracted from this sample. The embedded URLs are the primary indicators of malicious activity.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6097092097092097/Captain-of-the-Monte-Cristo-by-Sarah-K-L-Wilson.pdf
    • http://loaminoo.linkpc.net/1095090091099098/The-Sultan-of-Monte-Cristo-Sequels-to-the-Count-of-Monte-Cristo-1-by-Holy-Ghost-Writer.pdf
    • http://loaminoo.linkpc.net/6090096098091095/Le-comte-de-Monte-Cristo-Tome-IV-The-Count-of-Monte-Cristo-part-4-of-4-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/7091096093099/Le-Comte-De-Monte-Cristo-3-The-Count-of-Monte-Cristo-part-3-of-3-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/6097092096096094/O-Conde-de-Monte-Cristo-V-3-The-Count-of-Monte-Cristo-part-3-of-3-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/6097092097092098/The-Count-of-Monte-Cristo-Volume-V-The-Count-of-Monte-Cristo-5-of-5-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/6097092096095098/The-Count-of-Monte-Cristo-Volume-II-The-Count-of-Monte-Cristo-2-of-2-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/5090098093097/The-Count-of-Monte-Cristo-V1-The-Count-of-Monte-Cristo-part-1-of-2-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/4095096097093/Le-Comte-de-Monte-Cristo-I-Le-Comte-de-Monte-Cristo-1-of-2-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/5094097094096092/Contele-de-Monte-Cristo-Contele-de-Monte-Cristo-1-of-4-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/6090096099093096/Le-Comte-de-Monte-Cristo-by-Anonymous.pdf
    • http://loaminoo.linkpc.net/6090094091097095/The-Count-Of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/5093092090091095/The-Count-Of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/7095091091091092/The-Count-of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/7090099096091095/The-Count-of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/5092095098090099/The-Count-of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/3097098095097090/The-Count-of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/1098095096091095/The-Count-of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/7091095094099096/The-Count-of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/6093093097097/The-Count-of-Monte-Cristo-by-Alexandre-Dumas.pdf
    • http://loaminoo.linkpc.net/50900

Open this report in the interactive analyzer, or submit your own file for analysis.