Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6917975ed39f3ec…

MALICIOUS

PDF

18.5 KB Created: 2019-05-01 18:05:10 +01:00 Authoring application: mPDF 5.7
MD5: 603607df0548385d3712be626d88d0e0 SHA-1: 99f1001d0f14c01a87aa6787828dfc8ed5dae30f SHA-256: f6917975ed39f3ecb90c18bbbf2de44fb31155f96ccba58bf88ffab27cff4442
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a PDF_SEO_LINK_FARM, indicating a large number of embedded links. While the document body is heavily obfuscated and unreadable, the presence of numerous external links suggests an attempt to manipulate search engine results or distribute potentially malicious content. The links themselves point to various book titles, but their sheer volume and the context of a malicious verdict raise suspicion. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2090098091094093/Walk-on-Water-The-Miracle-of-Saving-Children-s-Lives-by-Michael-Ruhlman.pdf
    • http://loaminoo.linkpc.net/4092093099098092/Walk-on-Water-Inside-an-Elite-Pediatric-Surgical-Unit-by-Michael-Ruhlman.pdf
    • http://loaminoo.linkpc.net/3093095095093098/The-Chlorine-Revolution-Water-Disinfection-and-the-Fight-to-Save-Lives-by-Michael-J-McGuire.pdf
    • http://loaminoo.linkpc.net/3091091091090096/Charcuterie-The-Craft-of-Salting-Smoking-and-Curing-by-Michael-Ruhlman.pdf
    • http://loaminoo.linkpc.net/2095096090094099/The-Making-of-a-Chef-Mastering-Heat-at-the-Culinary-Institute-of-America-by-Michael-Ruhlman.pdf
    • http://loaminoo.linkpc.net/1098099098098093/If-You-Want-to-Walk-on-Water-You-ve-Got-to-Get-Out-of-the-Boat-by-John-Ortberg.pdf
    • http://loaminoo.linkpc.net/9095095093098095/A-Long-Walk-Up-the-Water-Slide-Neal-Carey-4-by-Don-Winslow.pdf
    • http://loaminoo.linkpc.net/2095098098096092/Burn-Unit-Saving-Lives-After-the-Flames-by-Barbara-Ravage.pdf
    • http://loaminoo.linkpc.net/1099094096093096/Medic-Saving-Lives-from-Dunkirk-to-Afghanistan-by-John-Nichol.pdf
    • http://loaminoo.linkpc.net/5094093090098098/Radiologists-at-Work-Saving-Lives-with-the-Lights-Off-X-Ray-Visions-Book-1-by-Carolyn-Jourdan.pdf
    • http://loaminoo.linkpc.net/3099099096092092/Teen-2-0-Saving-Our-Children-and-Families-from-the-Torment-of-Adolescence-by-Robert-Epstein.pdf
    • http://loaminoo.linkpc.net/3090096091090096/Last-Child-in-the-Woods-Saving-Our-Children-From-Nature-Deficit-Disorder-by-Richard-Louv.pdf
    • http://loaminoo.linkpc.net/8095092094092094/Stemi-3-Minute-Diagnosis-90-Minute-Reperfusion-Saving-Time-Saves-Lives-by-Marco-A-Mercader.pdf
    • http://loaminoo.linkpc.net/4099090091092093/Mirabelle-Goes-for-a-Walk-by-Michael-Muller.pdf
    • http://loaminoo.linkpc.net/4095093093091090/Saving-Mona-Lisa-by-Michael-Harrington.pdf
    • http://loaminoo.linkpc.net/2091090091092095/Saving-Michael-Surf-Bay-3-by-Ashley-John.pdf
    • http://loaminoo.linkpc.net/3097094097097097/The-Braxtons-of-Miracle-Springs-The-Journals-of-Corrie-amp-Christopher-1-by-Michael-R-Phillips.pdf
    • http://loaminoo.linkpc.net/3091092093092099/Children-s-books-Tardy-goes-to-Animal-School-The-Water-Bearz-Book-1-by-Dan-Keegan.pdf
    • http://loaminoo.linkpc.net/1091097090094096098/Shattered-Lives-Children-Who-Live-with-Courage-and-Dignity-by-Camila-Batmanghelidjh.pdf
    • http://loaminoo.linkpc.net/1094091098099090/Gift-Of-Faith-Tending-the-Spiritual-Lives-of-Children-by-Jeanne-Harrison-Nieuwejaar.pdf
    • http://loaminoo.linkpc.net/1099094096093096/M