Malicious PDF — malware analysis report

Static analysis result for SHA-256 eaeb5a32e7d9230f…

MALICIOUS

PDF

17.9 KB Created: 2019-04-30 07:59:35 +01:00 Authoring application: mPDF 5.7
MD5: 5d62df1c11a608b9c61b9cad041dad0d SHA-1: a204d4499847e7574141e4e927091a2eaf456077 SHA-256: eaeb5a32e7d9230fde2f0f8e719b599e0b893f3b63b9bc5b846efb28f813e158
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection as Pdf.Dropper.Agent-7098790-0 further supports its malicious nature. The embedded links are part of a link farm hosted on loaminoo.linkpc.net, suggesting an attempt to drive traffic or distribute further payloads.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7098790-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7098790-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2091096098099090/A-Stardance-Summer-Eternity-Springs-13-by-Emily-March.pdf
    • http://loaminoo.linkpc.net/2092095091090094/Christmas-in-Eternity-Springs-Eternity-Springs-12-by-Emily-March.pdf
    • http://loaminoo.linkpc.net/2091096099091096/The-First-Kiss-of-Spring-Eternity-Springs-14-by-Emily-March.pdf
    • http://loaminoo.linkpc.net/3092097099098097/Reflection-Point-Eternity-Springs-6-by-Emily-March.pdf
    • http://loaminoo.linkpc.net/3096093096095093/Heartache-Falls-Eternity-Springs-3-by-Emily-March.pdf
    • http://loaminoo.linkpc.net/2092095091093090/The-Christmas-Wishing-Tree-Eternity-Springs-15-by-Emily-March.pdf
    • http://loaminoo.linkpc.net/4092094096091092/Hot-Springs-Werewolf-Part-1-by-Emily-Cantore.pdf
    • http://loaminoo.linkpc.net/8097095090093/Touch-of-Eternity-The-Curse-1-by-Emily-Bold.pdf
    • http://loaminoo.linkpc.net/1095097095094094/The-Last-Summer-of-the-World-by-Emily-Mitchell.pdf
    • http://loaminoo.linkpc.net/7097096096097091/Love-on-the-Rocks-Summer-in-Whitehorse-Bay-by-Emily-Anne-Brandon.pdf
    • http://loaminoo.linkpc.net/7093098096093/The-Seasons-Vol-2-The-Springs-Box-Set-The-Springs-3-4-by-Elena-Aitken.pdf
    • http://loaminoo.linkpc.net/1091094096094096090/37-Color-Paintings-of-Alexander-Orlowski---Polish-Genre-Painter-March-9-1777---March-13-1832-by-Jacek-Michalak.pdf
    • http://loaminoo.linkpc.net/3097094094096090/Kid-Eternity-Book-One-Vertigo-Kid-Eternity-1-by-Ann-Nocenti.pdf
    • http://loaminoo.linkpc.net/3098090093093096/The-Cost-of-Eternity-Eternity-1-by-Shayla-Kersten.pdf
    • http://loaminoo.linkpc.net/8095093096099097/Tequila-and-Candy-Hearts-Blueberry-Springs-4-1-Blueberry-Springs-Sweet-Treats-1-by-Jean-Oram.pdf
    • http://loaminoo.linkpc.net/1099098092095098/Summer-of-Love-The-Principles-of-Love-5-by-Emily-Franklin.pdf
    • http://loaminoo.linkpc.net/1094090093092093/A-Summer-of-Hummingbirds-Love-Art-and-Scandal-in-the-Intersecting-Worlds-of-Emily-Dickinson-Mark-Twain-Harriet-Beecher-Stowe-and-Martin-Johnson-Heade-by-Christopher-E-G-Benfey.pdf
    • http://loaminoo.linkpc.net/1091095097097095094/The-Ghosts-of-Mystic-Springs-Mystic-Springs-1-by-Mona-Marple.pdf
    • http://loaminoo.linkpc.net/1091098097091090099/The-Secrets-of-Mystic-Springs-Mystic-Springs-2-by-Mona-Marple.pdf
    • http://loaminoo.linkpc.net/3095096097095094/Eternity-Eternity-1-by-S-Kodejs.pdf
    • http://loaminoo.linkpc.net/10910