Malicious PDF — malware analysis report

Static analysis result for SHA-256 d699fd51a696c51a…

MALICIOUS

PDF

13.9 KB Created: 2019-04-30 03:47:54 +01:00 Authoring application: mPDF 5.7
MD5: 9202feb10c77f6ede7a54648f837ab17 SHA-1: 57166d207c71e28d05e8a4ceb88f40dbdfec9ff9 SHA-256: d699fd51a696c51ae24626d418457b3a055eb886aa38ef5df32efe96d1faa8aa
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to a link farm, likely intended to drive traffic to pirated content. The heuristic 'PDF_SEO_LINK_FARM' indicates a malicious intent to generate traffic through a deceptive link structure. While no scripts were extracted, the embedded URLs themselves serve as the primary indicators of this attack pattern.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2098097092098090/The-Bourne-Supremacy-Jason-Bourne-2-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/5096093094096/The-Bourne-Trilogy-Jason-Bourne-1-3-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/3092096091094/The-Bourne-Identity-Jason-Bourne-1-by-Robert-Ludlum.pdf
    • http://loaminoo.linkpc.net/1094094091090095/The-Bourne-Legacy-Jason-Bourne-4-by-Eric-Van-Lustbader.pdf
    • http://loaminoo.linkpc.net/1094094090099095/The-Bourne-Betrayal-Jason-Bourne-5-by-Eric-Van-Lustbader.pdf
    • http://loaminoo.linkpc.net/2092097090093097/The-Bourne-Sanction-Jason-Bourne-6-by-Eric-Van-Lustbader.pdf
    • http://loaminoo.linkpc.net/9090099094092/The-Bourne-Objective-Jason-Bourne-8-by-Eric-Van-Lustbader.pdf
    • http://loaminoo.linkpc.net/6096094090098095/The-Bourne-Retribution-Jason-Bourne-11-by-Eric-Van-Lustbader.pdf
    • http://loaminoo.linkpc.net/2092097095091091/The-Bourne-Dominion-Jason-Bourne-9-by-Eric-Van-Lustbader.pdf
    • http://loaminoo.linkpc.net/5098095094090/The-Last-Testament-by-Sam-Bourne.pdf
    • http://loaminoo.linkpc.net/3090098098097/Shattered-Hourglass-by-J-L-Bourne.pdf
    • http://loaminoo.linkpc.net/6090093093090/Soulmates-by-Holly-Bourne.pdf
    • http://loaminoo.linkpc.net/1090090094094095/Beyond-Exile-Day-by-Day-Armageddon-2-by-J-L-Bourne.pdf
    • http://loaminoo.linkpc.net/6096096098/It-Only-Happens-in-the-Movies-by-Holly-Bourne.pdf
    • http://loaminoo.linkpc.net/5095094096093091/El-objetivo-de-Bourne-1-by-Eric-Van-Lustbader.pdf
    • http://loaminoo.linkpc.net/3091094098091090/Negative-Space-A-Play-in-One-Act-by-Bourne.pdf
    • http://loaminoo.linkpc.net/2090098091092096/Not-Looking-For-Love-Episode-1-by-Lena-Bourne.pdf
    • http://loaminoo.linkpc.net/1094098096094095/Rogue-Spy-Spymasters-5-by-Joanna-Bourne.pdf
    • http://loaminoo.linkpc.net/2094096093092091/The-Spymaster-s-Lady-by-Joanna-Bourne.pdf
    • http://loaminoo.linkpc.net/4099093098092095/Not-Looking-For-Love-Episode-1-by-Lena-Bourne.pdf
    • http://loaminoo.linkpc.net

Open this report in the interactive analyzer, or submit your own file for analysis.