Malicious PDF — malware analysis report

Static analysis result for SHA-256 caf00e1a1e7d3a57…

MALICIOUS

PDF

12.8 KB Created: 2019-04-30 11:20:03 +01:00 Authoring application: mPDF 5.7
MD5: 6eb2edf62617bde0fa7602c097a168ee SHA-1: b3732fd1dd490c1c2e593f55777dd520ab0cfc04 SHA-256: caf00e1a1e7d3a5710035ac24406bf693ec05872b4dbca1b14e9f80c9326bb73
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles hosted on loaminoo.linkpc.net. While the individual URLs are marked as confirmed benign, the sheer volume and pattern suggest a link farm intended to manipulate search engine results or direct users to potentially malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/9099091097096092/One-Man-s-Meat-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/1091097097097099093/Hai-S-Ph-n-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/6093097091099092/Heads-You-Win-A-Novel-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4094091099/This-Was-a-Man-The-Clifton-Chronicles-7-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4090099096098096/The-Sins-of-the-Father-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/5090092090091095/Paths-of-Glory-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/1093092090095090/The-Fourth-Estate-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4091093099093/The-Eleventh-Commandment-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4093099090093/A-Matter-of-Honor-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/3096092090099/As-the-Crow-Flies-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4097091090093091/A-Prisoner-of-Birth-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/1098090097096095/A-Prisoner-of-Birth-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4092097099093096/Paths-of-Glory-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4098097096099/Heaven-A-Prison-Diary-3-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/8098092095094/To-Cut-a-Long-Story-Short-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/7098091092091/Purgatory-A-Prison-Diary-2-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4098097091090090/Cometh-the-Hour-The-Clifton-Chronicles-6-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/8093095097094091/-ekneme-to-prezidentce-Kane-amp-Abel-3-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4091095093098094/The-Gospel-According-to-Judas-by-Benjamin-Iscariot-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/1091094091098091099/The-Complete-Clifton-Chronicles-Books-1-7-by-Jeffrey-Archer.pdf
    • http://loaminoo.linkpc.net/4092097099093096/Paths-of-Glory-by-Jeffrey-Archer

Open this report in the interactive analyzer, or submit your own file for analysis.