Malicious PDF — malware analysis report

Static analysis result for SHA-256 e96aa2ff5ed98451…

MALICIOUS

PDF

15.0 KB Created: 2019-05-02 19:46:12 +01:00 Authoring application: mPDF 5.7
MD5: 7d9a6b73902629c9cd25b25570caf006 SHA-1: dd99c7dbcf5eb2715abb2c59bdf5a4aecf106ea1 SHA-256: e96aa2ff5ed984513912f26e82c79b01346345263b0d986ee8029dcc6dbcd424
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are marked as benign, the sheer volume and structure suggest a malicious intent, possibly to manipulate search engine rankings or to serve as a lure for further malicious activity. No scripts were extracted from this sample. The attack pattern is inferred from the link farm heuristic.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1095091092092098/The-Man-on-a-Donkey-by-H-F-M-Prescott.pdf
    • http://loaminoo.linkpc.net/8093092090095099/Jill-Prescott-s-Ecole-De-Cuisine-Professional-Cooking-for-the-Home-Chef-by-Jill-Prescott.pdf
    • http://loaminoo.linkpc.net/7090093097098094/Bim-The-Little-Donkey-by-Jacques-Pr-vert.pdf
    • http://loaminoo.linkpc.net/2090098098091096/Seriously-Mum-Where-s-That-Donkey-by-Alan-Parks.pdf
    • http://loaminoo.linkpc.net/3090091096099094/Donkey-by-Stephanie-Brother.pdf
    • http://loaminoo.linkpc.net/3097093093093096/Just-a-Donkey-Like-You-and-Me-Ariol-1-by-Emmanuel-Guibert.pdf
    • http://loaminoo.linkpc.net/1094090099099/Devil-s-Donkey-by-Bill-Brittain.pdf
    • http://loaminoo.linkpc.net/1091096091095097/The-Wonky-Donkey-by-Craig-Smith.pdf
    • http://loaminoo.linkpc.net/1097095091094095/Swallowing-a-Donkey-s-Eye-by-Paul-Tremblay.pdf
    • http://loaminoo.linkpc.net/1094097096099097/Mikis-and-the-Donkey-by-Bibi-Dumon-Tak.pdf
    • http://loaminoo.linkpc.net/7094098094095/My-Uncle-s-Donkey-by-Tohby-Riddle.pdf
    • http://loaminoo.linkpc.net/1092091090095090/The-Silver-Donkey-A-Novel-for-Children-by-Sonya-Hartnett.pdf
    • http://loaminoo.linkpc.net/7097093092091094/The-Dead-Donkey-And-The-Guillotined-Woman-by-Jules-Janin.pdf
    • http://loaminoo.linkpc.net/5090092092095097/Donkey-Daniel-in-Bethlehem-Luke-2-1-18-for-Children-by-Janice-Kramer.pdf
    • http://loaminoo.linkpc.net/6090099099094093/Saving-Simon-How-a-Rescue-Donkey-Taught-Me-the-Meaning-of-Compassion-by-Jon-Katz.pdf
    • http://loaminoo.linkpc.net/7097093092092093/What-a-Way-to-Go-The-Guillotine-the-Pendulum-the-Thousand-Cuts-the-Spanish-Donkey-and-66-Other-Ways-of-Putting-Someone-to-Death-by-Geoffrey-Abbott.pdf
    • http://loaminoo.linkpc.net/3093091093095/The-Hurricane-by-R-J-Prescott.pdf
    • http://loaminoo.linkpc.net/2092096099093091/The-Reason-for-Me-by-Prescott-Lane.pdf
    • http://loaminoo.linkpc.net/4090097097093098/M-is-for-Monster-by-John-Prescott.pdf
    • http://loaminoo.linkpc.net/2095093097091099/To-the-Fall-by-Prescott-Lane.pdf
    • http://loaminoo.linkpc.net/1097095091094095/Swa

Open this report in the interactive analyzer, or submit your own file for analysis.