Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4750c90b143d33f…

MALICIOUS

PDF

17.9 KB Created: 2019-05-02 02:57:59 +01:00 Authoring application: mPDF 5.7
MD5: 4274001c6346723fb0cd29e3085fa9e2 SHA-1: bc14b49bc6c529f06153563545718b55e1c1d7b3 SHA-256: e4750c90b143d33ff891076c6e1bafcfb281732959fefc7c411012d5d4edd20e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates this behavior. While no scripts were extracted, the sheer volume of links suggests a coordinated effort to redirect users. The primary IOCs are the domain loaminoo.linkpc.net and the numerous linked PDF files.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1099091098097092/The-Storied-Life-of-A-J-Fikry-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/2090092094092097/The-Storied-Life-of-A-J-Fikry-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/1097095098096099/The-Storied-Life-of-A-J-Fikry-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/1090092095095/The-Storied-Life-of-A-J-Fikry-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/6099098099098097/Summary-of-The-Storied-Life-of-A-J-Fikry-A-Novel-by-Gabrielle-Zevin-Trivia-Quiz-for-Fans-by-Whiz-Books.pdf
    • http://loaminoo.linkpc.net/6099098099096091/The-Storied-Life-of-A-J-Fikry-A-Novel-by-Gabrielle-Zevin-Trivia-on-Books-by-Trivion-Books.pdf
    • http://loaminoo.linkpc.net/3095092095092090/The-Hole-We-re-in-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/1092096097095095/Because-It-Is-My-Blood-Birthright-2-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/2098095094094093/All-These-Things-I-ve-Done-Birthright-1-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/6099098099095098/Script-Conversations-with-Other-Women-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/2098090090092094/Memoirs-of-a-Teenage-Amnesiac-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/1097095099097098/Memoirs-of-a-Teenage-Amnesiac-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/6091097098/Young-Jane-Young-by-Gabrielle-Zevin.pdf
    • http://loaminoo.linkpc.net/2092097099095092/Dan-Gets-a-Minivan-Life-at-the-Intersection-of-Dude-and-Dad-by-Dan-Zevin.pdf
    • http://loaminoo.linkpc.net/6099098097095090/Entry-Level-Life-A-Complete-Guide-to-Masquerading-as-a-Member-of-the-Real-World-by-Dan-Zevin.pdf
    • http://loaminoo.linkpc.net/4094098095098091/Snowball-Earth-The-Story-of-the-Great-Global-Catastrophe-That-Spawned-Life-as-We-Know-It-by-Gabrielle-Walker.pdf
    • http://loaminoo.linkpc.net/4094099092096093/Miracles-Now-108-Life-Changing-Tools-for-Less-Stress-More-Flow-and-Finding-Your-True-Purpose-by-Gabrielle-Bernstein.pdf
    • http://loaminoo.linkpc.net/4099095091096/Oregon-This-Storied-Land-by-William-G-Robbins.pdf
    • http://loaminoo.linkpc.net/6093099097093096/Toile-The-Storied-Fabrics-of-Europe-and-America-by-Michele-Palmer.pdf
    • http://loaminoo.linkpc.net/6099098099095097/The-Nearly-Wed-Handbook-by-Dan-Zevin.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.