Malicious PDF — malware analysis report

Static analysis result for SHA-256 db2f8d089d6111ce…

MALICIOUS

PDF

17.4 KB Created: 2019-04-30 18:21:30 +01:00 Authoring application: mPDF 5.7
MD5: 784d70d8cd7b33a7da2536750769e5cb SHA-1: 3b911a45b8af85e9919fd2b1611ac348fc589ed7 SHA-256: db2f8d089d6111ce67327a0becc9f443879b3fdf0c5b41a606c91e70f59cd6eb
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links pointing to external PDF documents, a technique often used for SEO poisoning or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm. While the extracted URLs are currently marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent to redirect users. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/5096098090090091/River-Of-Ruin-Philip-Mercer-5-by-Jack-Du-Brul.pdf
    • http://loaminoo.linkpc.net/4093091091091096/Pandora-s-Curse-Philip-Mercer-4-by-Jack-Du-Brul.pdf
    • http://loaminoo.linkpc.net/7095096094096097/River-in-Ruin-The-Story-of-the-Carmel-River-by-Ray-A-March.pdf
    • http://loaminoo.linkpc.net/5091099096099099/Mercer-Magic-Roeblings-Kusers-The-Mercer-Automobile-Company-and-America-s-First-Sports-Car-by-Clifford-W-Zink.pdf
    • http://loaminoo.linkpc.net/2092098096099092/River-of-Eternity-by-Philip-Jos-Farmer.pdf
    • http://loaminoo.linkpc.net/1090098095096098/Tales-of-the-Rot-amp-Ruin-Rot-amp-Ruin-Dust-amp-Decay-Dead-amp-Gone-Flesh-amp-Bone-by-Jonathan-Maberry.pdf
    • http://loaminoo.linkpc.net/4095092095093091/The-Ruin-Series-Boxed-Set-Ruin-1-2-by-Rachel-Van-Dyken.pdf
    • http://loaminoo.linkpc.net/7096099099090097/Ruin-Series-Boxed-Set-Ruin-1-2-5-by-Rachel-Van-Dyken.pdf
    • http://loaminoo.linkpc.net/4095097097090/How-to-Ruin-Your-Boyfriend-s-Reputation-How-to-Ruin-3-by-Simone-Elkeles.pdf
    • http://loaminoo.linkpc.net/3094091098095094/The-Ogeechee-A-River-and-Its-People-by-Jack-Leigh.pdf
    • http://loaminoo.linkpc.net/2093095091090091/Rot-amp-Ruin-Rot-amp-Ruin-1-by-Jonathan-Maberry.pdf
    • http://loaminoo.linkpc.net/3094091093098/Rot-amp-Ruin-Rot-amp-Ruin-1-by-Jonathan-Maberry.pdf
    • http://loaminoo.linkpc.net/1093095098096/Jack-on-the-Tracks-Four-Seasons-of-Fifth-Grade-Jack-Henry-4-by-Jack-Gantos.pdf
    • http://loaminoo.linkpc.net/9092098097094094/Nahanni-River-of-Gold-River-of-Dreams-by-Neil-Hartling.pdf
    • http://loaminoo.linkpc.net/1091095099096090/River-River-Wolfe-1-by-Skyla-Dawn-Cameron.pdf
    • http://loaminoo.linkpc.net/4095090098095097/River-s-Rescue-River-s-End-9-by-Leanne-Davis.pdf
    • http://loaminoo.linkpc.net/3095097093097092/The-Bank-of-the-River-The-River-1-by-Michael-Richan.pdf
    • http://loaminoo.linkpc.net/8099090090095/Web-by-J-P-Mercer.pdf
    • http://loaminoo.linkpc.net/7096095098093094/Lewis-and-Clark-Trail-Maps-Missouri-River-Between-Camp-River-DuBois-Illinois-and-Fort-Mandan-North-Dakota--Outbound-1804-Return-1806-by-Martin-Plamondon.pdf
    • http://loaminoo.linkpc.net/1091095096097092090/Who-We-Were-Before-by-Leah-Mercer.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.