Malicious PDF — malware analysis report

Static analysis result for SHA-256 efeab1df6cd68324…

MALICIOUS

PDF

16.1 KB Created: 2019-05-02 18:29:40 +01:00 Authoring application: mPDF 5.7
MD5: 82bfc997a3829cd6e1b5142d48666ee6 SHA-1: 045ffe5fccd26d0747c6316fbda32e6357650774 SHA-256: efeab1df6cd683248ebf7b3f2aac56bc31fc1d65ddad73d0983af6171523c279
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, constituting a link farm. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with numerous numeric slugs pointing to book download sites. While the URLs themselves are marked as benign, the sheer volume and structure suggest a malicious intent to drive traffic or potentially host malicious content indirectly. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3091095090097090/Cage-of-Bones-amp-Other-Deadly-Obsessions-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/9099097096094097/Cage-of-Bones-amp-Other-Deadly-Obsessions-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/9099097097091096/Deadly-Nightlusts-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/4093092091098090/Cage-of-Bones-Brennan-amp-Esposito-3-by-Tania-Carver.pdf
    • http://loaminoo.linkpc.net/3098095098091/NightWhere-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/2092099099091098/The-13th-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/9099097097091097/Redemption-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/7097099096099098/Vigilantes-of-Love-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/9099097097093095/The-Crawling-Abattoir-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/9093094096093097/Field-of-Flesh-A-NightWhere-Novelette-by-John-Everson.pdf
    • http://loaminoo.linkpc.net/7099090096092/Four-Princes-Henry-VIII-Francis-I-Charles-V-Suleiman-the-Magnificent-and-the-Obsessions-that-Forged-Modern-Europe-by-John-Julius-Norwich.pdf
    • http://loaminoo.linkpc.net/2090096093096090/Four-Princes-Henry-VIII-Francis-I-Charles-V-Suleiman-the-Magnificent-and-the-Obsessions-that-Forged-Modern-Europe-by-John-Julius-Norwich.pdf
    • http://loaminoo.linkpc.net/2092098098094095/Composition-in-Retrospect-by-John-Cage.pdf
    • http://loaminoo.linkpc.net/4093094096092094/Out-of-the-Gilded-Cage-Condor-4-by-John-Simpson.pdf
    • http://loaminoo.linkpc.net/7092092092091097/John-Cage-Composed-in-America-by-Marjorie-Perloff.pdf
    • http://loaminoo.linkpc.net/1091095093098096096/Radio-Happenings-Conversations---Gespr-che-by-John-Cage.pdf
    • http://loaminoo.linkpc.net/9099097097092091/Cory-Everson-s-Life-Balance-by-Cory-Everson.pdf
    • http://loaminoo.linkpc.net/1091098094093098096/A-Morbid-Taste-for-Bones-by-John-Escott.pdf
    • http://loaminoo.linkpc.net/9094093090096099/No-Cage-for-a-Crow-Part-One-Into-the-Storm-No-Cage-for-a-Crow-1-by-M-R-Graham.pdf
    • http://loaminoo.linkpc.net/7099094098098099/Batman-The-Six-Deadly-Demons-by-John-Albano.pdf
    • http://loaminoo.linkpc.net/20900960930

Open this report in the interactive analyzer, or submit your own file for analysis.