Malicious PDF — malware analysis report

Static analysis result for SHA-256 d93efde1136f62cb…

MALICIOUS

PDF

12.5 KB Created: 2019-05-02 01:54:30 +01:00 Authoring application: mPDF 5.7
MD5: 8b33266b6345273708fff1fda7e8b83f SHA-1: 800244faa0614393b7ca5a04ef081d9939e4264a SHA-256: d93efde1136f62cb517934193976c9089754595afb580b449f8f8065f98c8c4e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm with numerous embedded URLs pointing to external PDF files. This technique is often used to obscure malicious intent or to distribute further malware. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' which strongly suggests this is the intended attack vector. No scripts were extracted, and the document body was unreadable, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4098091093098098/The-Jacqueline-Wilson-Christmas-Cracker-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/5097095098090092/The-Jacqueline-Wilson-Collection-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/5097095098099090/The-World-of-Jacqueline-Wilson-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/3096092094095096/Katy-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/1096098096099095/Lily-Alone-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/4092095091096094/The-Werepuppy-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/2094094093099099/The-Cat-Mummy-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/3097091093090096/Double-Act-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/3091092098094093/The-Mum-Minder-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/9091099096099098/Video-Rose-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/5099098099094/Paws-and-Whiskers-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/7096098094091091/Ma-chere-momie-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/4097099097099094/My-Secret-Diary-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/2098091096097096/Clean-Break-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/2096096096096091/Girls-Out-Late-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/2098091096097094/Dustbin-Baby-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/2096095096097093/Lola-Rose-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/4094097099096/Jacky-Daydream-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/5096090091094/How-to-Survive-Summer-Camp-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/6098095094095092/The-Monster-Story-Teller-by-Jacqueline-Wilson.pdf
    • http://loaminoo.linkpc.net/2098091096097096/C

Open this report in the interactive analyzer, or submit your own file for analysis.