Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2e262095bba4bb0…

MALICIOUS

PDF

16.8 KB Created: 2019-05-01 05:13:19 +01:00 Authoring application: mPDF 5.7
MD5: 6ff9f4188210069848f099105a2ae371 SHA-1: 62e2fb1837e1470fc25353b0780c71e2d9013e48 SHA-256: e2e262095bba4bb032f2e3f93588c98de944b310719a60749acdaa24e421080f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents. The heuristic 'PDF_SEO_LINK_FARM' indicates this is a link farm, suggesting the primary purpose is SEO manipulation or to serve as a distribution point for other malicious content. While the URLs themselves are marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent behind the document's creation. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091096098090091/Killer-Cruise-by-Jennifer-Shaw.pdf
    • http://loaminoo.linkpc.net/5096095091093093/Cruise-Killer-Marsha-amp-Danny-Jones-5-by-Ken-Rossignol.pdf
    • http://loaminoo.linkpc.net/5096095090098092/CRUISE-FACTS---TRUTH-amp-TIPS-ABOUT-CRUISE-TRAVEL-Traveling-Cheapskate-Series-Book-2-by-Ken-Rossignol.pdf
    • http://loaminoo.linkpc.net/1093095092093099/Cruise-Confidential-A-Hit-Below-the-Waterline-Where-the-Crew-Lives-Eats-Wars-and-Parties-One-Crazy-Year-Working-on-Cruise-Ships-by-Brian-David-Bruns.pdf
    • http://loaminoo.linkpc.net/8096099093094/The-Truth-About-Cruise-Ships-A-Cruise-Ship-Officer-Survives-the-Work-Adventure-Alcohol-and-Sex-of-Ship-Life-by-Jay-Herring.pdf
    • http://loaminoo.linkpc.net/4094094093091093/Pleasure-Cruise-Pleasure-Cruise-1-by-Michelle-M-Pillow.pdf
    • http://loaminoo.linkpc.net/3093090099093096/The-Diary-of-a-Killer-Cat-The-Killer-Cat-1-by-Anne-Fine.pdf
    • http://loaminoo.linkpc.net/5093097091096098/K-comme-killer-K-is-for-Killer-by-Sue-Grafton.pdf
    • http://loaminoo.linkpc.net/1097092094/Lady-Killer-Volume-1-Lady-Killer-1-by-Jo-lle-Jones.pdf
    • http://loaminoo.linkpc.net/4099098096094/Set-in-Stone-by-Anna-Cruise.pdf
    • http://loaminoo.linkpc.net/5094090094091/Killer-of-Enemies-Killer-of-Enemies-1-by-Joseph-Bruchac.pdf
    • http://loaminoo.linkpc.net/5092099094096096/Camus-by-Conor-Cruise-O-39-Brien.pdf
    • http://loaminoo.linkpc.net/9092098094092/Little-Mam-Forgets-by-Robin-Cruise.pdf
    • http://loaminoo.linkpc.net/3094092092093099/It-Was-You-Abby-and-West-1-by-Anna-Cruise.pdf
    • http://loaminoo.linkpc.net/9099097097098092/First-Cruise-of-the-Montauk-by-Samuel-T-Browne.pdf
    • http://loaminoo.linkpc.net/1090096091090091091/The-Girls-of-SoHo-by-Vera-Cruise.pdf
    • http://loaminoo.linkpc.net/7096098092099092/CRUISE-THE-RHINE-and-MOSELLE-by-DRMW.pdf
    • http://loaminoo.linkpc.net/1090094095094097096/All-He-Wants-Annika-amp-Stuart-2-by-Anna-Cruise.pdf
    • http://loaminoo.linkpc.net/3097095098099097/Lane-Changes-PI-Cassie-Cruise-1-by-S-L-Ellis.pdf
    • http://loaminoo.linkpc.net/4097099095096094/The-Sunshine-Cruise-Company-by-John-Niven.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.