Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec6d723242d144fe…

MALICIOUS

PDF

15.4 KB Created: 2019-05-02 01:42:20 +01:00 Authoring application: mPDF 5.7
MD5: 43754313d3e474cb9a5c04a163bb74d7 SHA-1: 29f4c5f000142b0160723687904f46ed91682cff SHA-256: ec6d723242d144fe56ed96b3cc79bef4a869a523733c591c94f552f1591ce2f1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO poisoning or to redirect users to malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm with 32 links, many of which are numeric slugs. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent to drive traffic or potentially host further malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091094094098092091/Tief-in-angenehmen-Abenteuern---Giacomo-Casanova-ber-Gl-ck-Liebe-Frauen-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/7090092094094099/M-moires-de-Jacques-Casanova-de-Seingalt-crits-par-lui-m-me-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/5099091097094090/Memoirs-of-Casanova-Volume-02-a-Cleric-in-Naples-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/3099091099097091/The-Memoirs-of-Jacques-Casanova-Vol-1-Venetian-Years-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/8094094093090093/The-Nun-of-Murano-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/8094094092099095/History-of-My-Life-Volumes-III-amp-IV-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/8094094093090098/History-of-My-Life-Volume-IX-amp-X-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/3091090091098/History-of-My-Life-Vols-I-amp-II-by-Giacomo-Casanova.pdf
    • http://loaminoo.linkpc.net/7090099092098091/Lettre-Inedite-de-Giacomo-Leopardi-a-Charlotte-Bonaparte-Retrouvee-a-Paris-En-1993-by-Giacomo-Leopardi.pdf
    • http://loaminoo.linkpc.net/8094094095094094/Letters-of-Giacomo-Puccini-by-Giacomo-Puccini.pdf
    • http://loaminoo.linkpc.net/8094094092093096/Funereal-by-Giacomo-Lee.pdf
    • http://loaminoo.linkpc.net/5097090099090/Casanova-by-Andrew-Miller.pdf
    • http://loaminoo.linkpc.net/7091098092094094/Casanova-by-David-Greig.pdf
    • http://loaminoo.linkpc.net/4090090094095091/Jess-by-Mary-Casanova.pdf
    • http://loaminoo.linkpc.net/1095093094093094/Frozen-by-Mary-Casanova.pdf
    • http://loaminoo.linkpc.net/7091098092094095/Casanova-by-Andrew-Miller.pdf
    • http://loaminoo.linkpc.net/1090095091096094090/Wolf-Shadows-by-Mary-Casanova.pdf
    • http://loaminoo.linkpc.net/7091098092097091/The-Klipfish-Code-by-Mary-Casanova.pdf
    • http://loaminoo.linkpc.net/7091098092093092/What-Casanova-Told-Me-A-Novel-by-Susan-Swan.pdf
    • http://loaminoo.linkpc.net/7091098091098098/Marginalia-on-Casanova-by-Mikl-s-Szentkuthy.pdf
    • http://loaminoo.linkpc.net/3091090091098/History-of-My-Life-Vols-I-amp-II-by-Giacomo-Casan

Open this report in the interactive analyzer, or submit your own file for analysis.