Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6904f4c4cfbaccd…

MALICIOUS

PDF

14.6 KB Created: 2019-04-30 02:34:51 +01:00 Authoring application: mPDF 5.7
MD5: 3fe5a93820164315989557a26040caf6 SHA-1: d1733c3d0ca34f6e4544f34c1899613cebccf1eb SHA-256: e6904f4c4cfbaccdb0c77242265d2658e4774e0c80255e29c01d99d60c4d3270
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a heuristic firing for a link farm, indicating a large number of external URLs embedded within the document. These URLs, such as http://loaminoo.linkpc.net/4091093093097094/The-Tooth-Fairy-by-Graham-Joyce.pdf, are likely used to redirect users to malicious sites. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/4091093093097094/The-Tooth-Fairy-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/9095097095092/The-Tooth-Fairy-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/3095093097094094/Sonny-Preyer-A-Fairy-Tale-of-a-Different-Kind-1-by-Bridgette-Hayden.pdf
    • http://loaminoo.linkpc.net/1098097090093097/Fairy-Tale-Weddings-Cindy-and-the-Prince-Some-Kind-of-Wonderful-by-Debbie-Macomber.pdf
    • http://loaminoo.linkpc.net/1092095093090090/A-Fairy-Tale-Fairy-Tale-1-by-Shanna-Swendson.pdf
    • http://loaminoo.linkpc.net/3096092090090096/Americana-Fairy-Tale-Fairy-Tales-of-the-Open-Road-1-by-Lex-Chase.pdf
    • http://loaminoo.linkpc.net/4091094097098094/Americana-Fairy-Tale-Fairy-Tales-of-the-Open-Road-1-by-Lex-Chase.pdf
    • http://loaminoo.linkpc.net/2098095091095098/Christian-Lacroix-and-the-Tale-of-Sleeping-Beauty-A-Fashion-Fairy-Tale-Memoir-by-Camilla-Morton.pdf
    • http://loaminoo.linkpc.net/2090094097093090/Cat-s-Tale-A-Fairy-Tale-Retold-by-Bettie-Sharpe.pdf
    • http://loaminoo.linkpc.net/4090097091090091/Dreamside-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/4099094092094093/The-Silent-Land-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/2096090097096/The-Silent-Land-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/1095099094094093/The-Facts-of-Life-A-Novel-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/2095098097090/The-Facts-of-Life-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/4096092099095092/Dark-Sister-by-Graham-Joyce.pdf
    • http://loaminoo.linkpc.net/3097096096097/A-Tale-of-the-Other-Kind-Therian-1-by-Leandi-Cameron.pdf
    • http://loaminoo.linkpc.net/7092095095091/Have-Courage-Be-Kind-The-Tale-of-Cinderella-by-Brittany-Candau.pdf
    • http://loaminoo.linkpc.net/1099099095097097/Wings-A-Fairy-Tale-Fairy-Wings-1-by-E-D-Baker.pdf
    • http://loaminoo.linkpc.net/4092094092091092/Little-Red-Not-Quite-the-Fairy-Tale-5-by-May-Sage.pdf
    • http://loaminoo.linkpc.net/2098098093092091/Fairy-Tale-by-Cyn-Balog.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.