Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0f314ceb3d77db2…

MALICIOUS

PDF

16.9 KB Created: 2019-04-30 04:54:44 +01:00 Authoring application: mPDF 5.7
MD5: 71147452d96c4303617a354f232e251f SHA-1: f06fdc958c1a4c15c6e52696e6e486c359a000a0 SHA-256: d0f314ceb3d77db2fa2e6677ddafe405e99e12dc0e25be2e665057e4dbee038e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While most of these URLs are marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to distribute further malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/8099097099092/Akiko-Flights-of-Fancy---The-High-Flying-Expanded-Edition-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/8099096093096/Akiko-Flights-of-Fancy-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/9090090093090/Mastering-Manga-with-Mark-Crilley-30-Drawing-Lessons-from-the-Creator-of-Akiko-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/8096098093093/Akiko-in-the-Sprubly-Islands-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/8097097092099/Akiko-and-the-Journey-to-Toog-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/8097091096096/Akiko-in-the-Castle-of-Alia-Rellapor-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/8098098099098/Akiko-The-Menace-of-Alia-Rellapor-Volume-3-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/4096099096095091/Flying-High-Freighter-Flights-2-by-Drew-Zachary.pdf
    • http://loaminoo.linkpc.net/9090094099091/Mastering-Manga-3-Power-Up-with-Mark-Crilley-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/4099095099095098/Knights-of-Desire-Flights-of-Fancy-2-by-Melodee-Aaron.pdf
    • http://loaminoo.linkpc.net/1090091097090099091/A-Primer-for-Local-Historical-Societies-Revised-and-Expanded-from-the-First-Edition-by-Dorothy-Weyer-Creigh-Revised-and-Expanded-from-the-First-Edition-by-Dorothy-Weyer-Creigh-by-Laurence-R-Pizer.pdf
    • http://loaminoo.linkpc.net/8094095095097/Brody-s-Ghost-Volume-2-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/8094092095099/Brody-s-Ghost-Volume-1-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/8094098090094/Brody-s-Ghost-Volume-3-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/8095098095095/Miki-Falls-Volume-1-Spring-by-Mark-Crilley.pdf
    • http://loaminoo.linkpc.net/5097090092092/Gun-Control-amp-The-Second-Amendment-2nd-Edition-Revised-amp-Expanded-by-Byron-Goines.pdf
    • http://loaminoo.linkpc.net/8092094098093092/Writing-the-Cozy-Mystery-Expanded-Second-Edition-by-Nancy-J-Cohen.pdf
    • http://loaminoo.linkpc.net/9096098096093090/The-Complete-Book-of-Abs-Revised-and-Expanded-Edition-by-Kurt-Brungardt.pdf
    • http://loaminoo.linkpc.net/6094092097097094/The-Anatomy-of-Revolution-Revised-and-Expanded-Edition-by-Crane-Brinton.pdf
    • http://loaminoo.linkpc.net/1096091099093091/Thinking-in-Pictures-Expanded-Edition-My-Life-with-Autism-by-Temple-Grandin.pdf
    • http://loaminoo.linkpc.net/1090091097090099091/A-Primer-for-Local-Historical-Societies-Revised-an

Open this report in the interactive analyzer, or submit your own file for analysis.