Malicious PDF — malware analysis report

Static analysis result for SHA-256 d609066c31265e60…

MALICIOUS

PDF

15.7 KB Created: 2019-05-04 14:33:29 +01:00 Authoring application: mPDF 5.7
MD5: 6b8c9cbb78ae1b5da19194922af24ba5 SHA-1: 85901fa7241f9f4c0fbc7fb6286d92684d6c14eb SHA-256: d609066c31265e60f83ca1d57b099e0b18ddcb4a5d979d86621a668a59f8533e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified as a link farm. These URLs point to what appear to be book downloads, suggesting a social engineering tactic to drive traffic to external sites. No scripts were extracted from this sample. The primary attack pattern involves leveraging a large number of links to potentially distribute malicious content or engage in SEO manipulation.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3093095094090/Obsidian-Butterfly-Anita-Blake-Vampire-Hunter-9-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/2093090092095097/Obsidian-Butterfly-Anita-Blake-Vampire-Hunter-9-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/7098099094096097/Laurell-K-Hamilton-s-Anita-Blake-Vampire-Hunter---The-First-Death-1-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/8096097098092/Anita-Blake-Vampire-Hunter-Collection-1-4-Anita-Blake-Vampire-Hunter-1-4-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/1099099096098091/Flirt-Anita-Blake-Vampire-Hunter-18-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3096090097090/Micah-Anita-Blake-Vampire-Hunter-13-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/1090095096/Dead-Ice-Anita-Blake-Vampire-Hunter-24-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/8096095099/Serpentine-Anita-Blake-Vampire-Hunter-26-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3092093099092092/Blue-Moon-Anita-Blake-Vampire-Hunter-8-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3090093097099093/Strange-Candy-Anita-Blake-Vampire-Hunter-0-5-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3092097090093/Guilty-Pleasures-Anita-Blake-Vampire-Hunter-1-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/8096091091091/The-Midnight-Cafe-Anita-Blake-Vampire-Hunter-4-6-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/1090098097097/Skin-Trade-Anita-Blake-Vampire-Hunter-17-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/8095094092098/Black-Moon-Inn-Anita-Blake-Vampire-Hunter-7-8-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/4090092091099099/Bloody-Bones-Anita-Blake-Vampire-Hunter-5-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3093097093096/The-Killing-Dance-Anita-Blake-Vampire-Hunter-6-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3093098098094/Bloody-Bones-Anita-Blake-Vampire-Hunter-5-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/4097096097096/Strange-Candy-Anita-Blake-Vampire-Hunter-0-5-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3092094091090098/The-Lunatic-Cafe-Anita-Blake-Vampire-Hunter-4-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3090094097094093/The-Laughing-Corpse-Anita-Blake-Vampire-Hunter-2-by-Laurell-K-Hamilton.pdf
    • http://loaminoo.linkpc.net/3090093097099093/Strange-Candy-An

Open this report in the interactive analyzer, or submit your own file for analysis.