Malicious PDF — malware analysis report

Static analysis result for SHA-256 e609c93b3d2ca085…

MALICIOUS

PDF

16.6 KB Created: 2019-04-30 03:47:11 +01:00 Authoring application: mPDF 5.7
MD5: ffbc4b273ca3e3cfa7633c1746470773 SHA-1: d67956ec76b0c7831c9986fe1ffb39ff43bcf005 SHA-256: e609c93b3d2ca0854d1bdd96442e58c10e9594737ce32918e42e1c3527eff0b8
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded links to external URLs, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO spam or to redirect users to malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.lin
    • http://loaminoo.linkpc.net/1096097099099093/Midnight-Kiss-Touched-by-Midnight-1-by-Nancy-Gideon.pdf
    • http://loaminoo.linkpc.net/1091095098097090/Midnight-Kiss-Midnight-1-by-Nancy-Gideon.pdf
    • http://loaminoo.linkpc.net/4094094091097099/The-Dark-Warrior-Series-The-Complete-Collection-Contains-Midnight-s-Master-Midnight-s-Lover-Midnight-s-Seduction-Midnight-s-Warrior-Midnight-s-Kiss-Surrender-novella-Dark-Warriors-by-Donna-Grant.pdf
    • http://loaminoo.linkpc.net/1092099097092/Midnight-Kiss-by-Marcia-Evanick.pdf
    • http://loaminoo.linkpc.net/2094098099093093/Tempted-by-Midnight-Midnight-Breed-12-5-1001-Dark-Nights-9-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/4095096098098092/Either-Side-of-Midnight-The-Midnight-Saga-Book-1-by-Tori-de-Clare.pdf
    • http://loaminoo.linkpc.net/3091097098099097/Cat-in-a-Midnight-Choir-Midnight-Louie-14-by-Carole-Nelson-Douglas.pdf
    • http://loaminoo.linkpc.net/3092097092098091/Red-Kiss-Gods-of-Midnight-2-by-Deidre-Knight.pdf
    • http://loaminoo.linkpc.net/3099090092093094/Deeper-Than-Midnight-Midnight-Breed-9-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/3095097094093097/Midnight-Rising-Midnight-Breed-4-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/4090096091099096/Shades-of-Midnight-Midnight-Breed-7-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/3097096093095097/A-Touch-of-Midnight-Midnight-Breed-0-5-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/3093097097094/Midnight-Awakening-Midnight-Breed-3-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/1097092094092093/Midnight-Awakening-Midnight-Breed-3-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/3096090098094095/Midnight-Promises-Men-of-Midnight-2-by-Lisa-Marie-Rice.pdf
    • http://loaminoo.linkpc.net/4090099095091094/Midnight-Awakening-Midnight-Breed-3-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/1093093096090099/A-Touch-of-Midnight-Midnight-Breed-0-5-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/3094095098099/Ashes-of-Midnight-Midnight-Breed-6-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/3093099096090090/Darker-After-Midnight-Midnight-Breed-10-by-Lara-Adrian.pdf
    • http://loaminoo.linkpc.net/2099094096099095/Secrets-of-Midnight-Chronicles-of-Midnight-3-by-Debbie-Cassidy.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.