Malicious PDF — malware analysis report

Static analysis result for SHA-256 e578ae715578d2f8…

MALICIOUS

PDF

13.3 KB Created: 2019-05-02 01:42:45 +01:00 Authoring application: mPDF 5.7
MD5: 79986fbefb1bf079153440df103a4f86 SHA-1: da91b8a766a96e9c829c57c468a46469df8caa90 SHA-256: e578ae715578d2f8b31066ecd61aed90ea0133a73e2e280bfae6bd7d1613555f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links pointing to external PDF documents hosted on the domain 'loaminoo.linkpc.net'. This heuristic firing indicates a link farm, likely intended to drive traffic or distribute further malicious content. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the immediate intent beyond the link farm. The primary IOC is the suspicious domain hosting these links.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1099099092097093/Remember-Me-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/2095097096093099/Truth-Or-Lie-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/2095097098099090/Coliseum-Square-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/3092098098090090/No-Good-Deed-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/1096091091094094/His-Duke-s-Gift-In-The-Company-Of-Men-5-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/4091098099093099/Jackson-s-Pride-In-the-Company-of-Men-2-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/4097098091093098/Silent-Lodge-In-the-Company-of-Men-4-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/2093095095091091/Soul-Bonds-Common-Powers-1-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/2098095099090095/Edward-Unconditionally-Common-Powers-3-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/3095093097092096/Bayou-Loup-Rougaroux-Social-Club-3-by-Lynn-Lorenz.pdf
    • http://loaminoo.linkpc.net/3097097091092095/Adwaka-s-Blade-Lady-Blue-Crew-4-by-Lynn-Hagen.pdf
    • http://loaminoo.linkpc.net/3095092095099097/The-Hidden-Blade-The-Heart-of-Blade-Duology-1-by-Sherry-Thomas.pdf
    • http://loaminoo.linkpc.net/3092096099090096/Bared-Blade-Fallen-Blade-2-by-Kelly-McCullough.pdf
    • http://loaminoo.linkpc.net/3092098092090098/Blade-Reforged-Fallen-Blade-4-by-Kelly-McCullough.pdf
    • http://loaminoo.linkpc.net/2095096094095/Blade-on-the-Hunt-Goddess-With-A-Blade-3-by-Lauren-Dane.pdf
    • http://loaminoo.linkpc.net/1099096093093094/Blade-to-the-Keep-Goddess-With-A-Blade-2-by-Lauren-Dane.pdf
    • http://loaminoo.linkpc.net/1091092092094099099/The-Correspondence-of-John-Locke-3-Letters-849-1241-1686-89-by-John-Locke.pdf
    • http://loaminoo.linkpc.net/2098095096096099/The-Name-of-the-Blade-The-Name-of-the-Blade-1-by-Zo-Marriott.pdf
    • http://loaminoo.linkpc.net/7096092091099095/Angel-Blade-Angel-Blade-1-by-Carrie-Merrill.pdf
    • http://loaminoo.linkpc.net/1095096093099091/The-Queen-s-Blade-The-Queen-s-Blade-1-by-T-C-Southwell.pdf
    • http://loaminoo.linkpc.net/3092098092090098/Blade-Reforged-Fallen-Blade-4-by-Kelly-McCulloug

Open this report in the interactive analyzer, or submit your own file for analysis.