Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd2dbe2ba80c41f7…

MALICIOUS

PDF

20.7 KB Created: 2019-04-30 03:55:39 +01:00 Authoring application: mPDF 5.7
MD5: 802c3756d0cc66f32af698ab74deb727 SHA-1: cf1e449f10f25baad38ae54cd144206e3722b2aa SHA-256: dd2dbe2ba80c41f79578743b7cff1918c9257ce0a33011453b8f736c2c51917c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various documents hosted on loaminoo.linkpc.net. While the URLs themselves are marked as benign, the sheer volume and the nature of the heuristic suggest a link farm intended to drive traffic or potentially host malicious content indirectly. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the immediate intent beyond link distribution.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/6098093094097096/Digital-and-Analog-Fiber-Optic-Communications-for-CATV-and-FTTx-Applications-SPIE-Press-Monograph-Vol-PM174-Press-Monograph-Spie-Press-Monograph-by-Avigdor-Brillant.pdf
    • http://loaminoo.linkpc.net/7094094090097095/Foster-Associates-Architectural-Monograph-by-Architectural-Monograph.pdf
    • http://loaminoo.linkpc.net/1091091093091096098/The-Jewish-Press---A-Gevalt-from-the-Torah-True-An-Examination-of-the-Concepts-Holocaust-and-Israel-in-the-American-Jewish-Newspaper-the-Jewish-Press-by-Sahra-L-Lindeberg.pdf
    • http://loaminoo.linkpc.net/7094093099094095/Frederick-H-Evans-Pa-by-Monograph.pdf
    • http://loaminoo.linkpc.net/7094094091097093/Monograph-of-the-Choanephoraceae-by-Paul-M-Kirk.pdf
    • http://loaminoo.linkpc.net/7094094091097092/The-Bulldog---A-Monograph-by-Edgar-Farman.pdf
    • http://loaminoo.linkpc.net/4095098092099092/Stelarc-The-Monograph-by-Marquard-Smith.pdf
    • http://loaminoo.linkpc.net/7094094090097092/Robert-A-M-Stern-by-Architectural-Monograph.pdf
    • http://loaminoo.linkpc.net/7094094093092097/A-Monograph-of-Odontoglossum-by-James-Bateman.pdf
    • http://loaminoo.linkpc.net/7094094090098096/Photographs-An-Aperture-Monograph-by-William-Klein.pdf
    • http://loaminoo.linkpc.net/7094094090091098/The-Mathematics-of-Bookselling-A-Monograph-by-Leonard-Shatzkin.pdf
    • http://loaminoo.linkpc.net/7094094093093097/Fairweather-Art-amp-Australia-Monograph-by-Murray-Bail.pdf
    • http://loaminoo.linkpc.net/7094094090092091/Theogony-Academic-Monograph-Reprints-by-Hesiod.pdf
    • http://loaminoo.linkpc.net/7094094091097098/Charlotte-Bront-A-Monograph-by-Thomas-Wemyss-Reid.pdf
    • http://loaminoo.linkpc.net/7094094093092091/J-M-Barrie-A-Walck-Monograph-by-Roger-Lancelyn-Green.pdf
    • http://loaminoo.linkpc.net/7094094091097099/The-Estimation-Of-Probabilities-Research-Monograph-by-Irving-John-Good.pdf
    • http://loaminoo.linkpc.net/7094094091098093/Theophano-The-Crusade-of-the-Tenth-Century-A-Romantic-Monograph-by-Frederic-Harrison.pdf
    • http://loaminoo.linkpc.net/7094093099094096/Paradise-Lost-the-Text-Reprod-from-the-1st-Ed-of-1667-with-an-Appendix-and-a-Monograph-By-R-H-Shepherd-by-John-Milton.pdf
    • http://loaminoo.linkpc.net/1090097098092096090/DEPRESSION-Advancing-the-Treatment-Paradigm-Functional-Medicine-Monograph-Series-by-Robert-Hedaya.pdf
    • http://loaminoo.linkpc.net/2091090097092098/Northwest-Coast-Indian-Art-An-Analysis-of-Form-Thomas-Burke-Memorial-Washington-State-Monograph-by-Bill-Holm.pdf