Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9419413fae205b3…

MALICIOUS

PDF

16.8 KB Created: 2019-05-02 01:38:18 +01:00 Authoring application: mPDF 5.7
MD5: 89c1348532b44b28fb4e03333c705c62 SHA-1: 34619673c9afcc8f697faedcd205caa2808afc9b SHA-256: c9419413fae205b3b7d9b0509d198a6009f266f43e9c98978a2fb625daf4e160
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm. While the URLs themselves are currently marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent to redirect users. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2094091095092097/Prisoners-A-Muslim-and-a-Jew-Across-the-Middle-East-Divide-by-Jeffrey-Goldberg.pdf
    • http://loaminoo.linkpc.net/8092094099093/Prisoners-A-Story-of-Friendship-and-Terror-by-Jeffrey-Goldberg.pdf
    • http://loaminoo.linkpc.net/1098094091097090/Children-in-the-Muslim-Middle-East-by-Elizabeth-Warnock-Fernea.pdf
    • http://loaminoo.linkpc.net/5098098096095090/Prophetic-Voices-on-Middle-East-Peace-A-Jewish-Christian-and-Humanist-Primer-on-Colonialism-Zionism-amp-Nationalism-in-the-Middle-East-by-Thomas-E-Phillips.pdf
    • http://loaminoo.linkpc.net/6090099094097096/The-Civilizations-of-the-East-Near-and-Middle-East-by-Ren-Grousset.pdf
    • http://loaminoo.linkpc.net/5090092099099095/Muslim-Rebels-Kharijites-and-the-Politics-of-Extremism-in-Egypt-by-Jeffrey-T-Kenney.pdf
    • http://loaminoo.linkpc.net/9092095097092098/Assignment-Cyprus-Middle-East-Mission-by-Trooper.pdf
    • http://loaminoo.linkpc.net/9091093097098/The-Middle-East-Bedside-Book-by-Tahir-Shah.pdf
    • http://loaminoo.linkpc.net/8096090097096092/A-Concise-History-of-the-Middle-East-by-Arthur-Goldschmidt-Jr-.pdf
    • http://loaminoo.linkpc.net/3098094091091090/America-s-War-for-the-Greater-Middle-East-by-Andrew-J-Bacevich.pdf
    • http://loaminoo.linkpc.net/6091093096094098/The-Multiple-Identities-of-the-Middle-East-by-Bernard-Lewis.pdf
    • http://loaminoo.linkpc.net/1091098090094099092/Middle-East-War-Imperialism-and-Ecology-by-Roland-Rance.pdf
    • http://loaminoo.linkpc.net/4094096099091092/Witchcraft-in-the-Middle-Ages-by-Jeffrey-Burton-Russell.pdf
    • http://loaminoo.linkpc.net/1095094095094096/The-Next-Founders-Voices-of-Democracy-in-the-Middle-East-by-Joshua-Muravchik.pdf
    • http://loaminoo.linkpc.net/1094099097094/19-Varieties-of-Gazelle-Poems-of-the-Middle-East-by-Naomi-Shihab-Nye.pdf
    • http://loaminoo.linkpc.net/4090093097095091/The-Poisoned-Well-Empire-and-Its-Legacy-in-the-Middle-East-by-Roger-Hardy.pdf
    • http://loaminoo.linkpc.net/6094098093095099/Madinah-City-Stories-from-the-Middle-East-by-Joumana-Haddad.pdf
    • http://loaminoo.linkpc.net/5099097092093090/From-Babel-to-Dragomans-Interpreting-the-Middle-East-by-Bernard-Lewis.pdf
    • http://loaminoo.linkpc.net/3097095097094095/Six-Days-How-the-1967-War-Shaped-the-Middle-East-by-Jeremy-Bowen.pdf
    • http://loaminoo.linkpc.net/6097090093097095/The-Arab-Awakening-Islam-and-the-New-Middle-East-by-Tariq-Ramadan.pdf
    • http://loaminoo.linkpc.net/8096090097096092/A-Concise-History-of-the-Middle-East

Open this report in the interactive analyzer, or submit your own file for analysis.