Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa210b517d44a708…

MALICIOUS

PDF

16.8 KB Created: 2019-04-30 04:38:33 +01:00 Authoring application: mPDF 5.7
MD5: 5a9e8e0b66f103273502ee6db8e4b64f SHA-1: b7e740843c9c977ebd0b80c1c9580575e1c08b09 SHA-256: fa210b517d44a70840cd36dab21f14b16e2f27275d9bb59f07395b5661ccfc6e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various PDF documents hosted on loaminoo.linkpc.net. While the individual URLs are marked as benign, the sheer volume and pattern suggest a link farm or SEO manipulation tactic. No scripts were extracted from this sample. The attack pattern is inferred from the link farm heuristic.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/2095090099092094/Idle-Feet-Do-the-Devil-s-Work-by-Ray-Charbonneau.pdf
    • http://loaminoo.linkpc.net/1091098098096091096/Band-Tumbler-Work-Log-Work-Journal-Work-Diary-Log---131-Pages-8-5-X-11-Inches-by-Key-Work-Logs.pdf
    • http://loaminoo.linkpc.net/6092097098090097/Why-the-Devil-Chose-New-England-for-His-Work-Stories-by-Jason-Brown.pdf
    • http://loaminoo.linkpc.net/1092092096096092/Waltzing-in-Ragtime-by-Eileen-Charbonneau.pdf
    • http://loaminoo.linkpc.net/1097090095091091/Eve-s-Evolution-Erotic-Secrets-1-by-Olympia-Charbonneau.pdf
    • http://loaminoo.linkpc.net/4098091097099/Independent-Study-The-Testing-2-by-Joelle-Charbonneau.pdf
    • http://loaminoo.linkpc.net/1094092095094095/How-to-Be-Idle-by-Tom-Hodgkinson.pdf
    • http://loaminoo.linkpc.net/3096090093096098/Skating-Around-the-Law-Rebecca-Robbins-Mystery-1-by-Joelle-Charbonneau.pdf
    • http://loaminoo.linkpc.net/5094097090092097/A-Chorus-Line-Up-Glee-Club-3-by-Joelle-Charbonneau.pdf
    • http://loaminoo.linkpc.net/3097098097094091/Watch-Over-Me-Code-Talker-Chronicles-Book-2-by-Eileen-Charbonneau.pdf
    • http://loaminoo.linkpc.net/1090096096096099091/IDLE-TALK-by-KAGURAZAKA-RASEN.pdf
    • http://loaminoo.linkpc.net/3091093090094/Flora-and-the-Flamingo-by-Molly-Idle.pdf
    • http://loaminoo.linkpc.net/3093092093091093/The-Idle-City-by-Lord-Dunsany.pdf
    • http://loaminoo.linkpc.net/3092097093096090/The-Idle-Warriors-by-Kerry-W-Thornley.pdf
    • http://loaminoo.linkpc.net/6098095095090/The-Road-To-Mars-by-Eric-Idle.pdf
    • http://loaminoo.linkpc.net/8095091090/Idle-The-Seven-Deadly-4-by-Fisher-Amelie.pdf
    • http://loaminoo.linkpc.net/7090090091093096/Idle-Days-on-the-Yann-by-Lord-Dunsany.pdf
    • http://loaminoo.linkpc.net/1090092091096098/The-Idle-Traveller-The-Art-of-Slow-Travel-by-Dan-Kieran.pdf
    • http://loaminoo.linkpc.net/7094094091098090/A-Theology-Of-Work-Work-And-The-New-Creation-Paternoster-Theological-Monographs-by-Darrell-Cosden.pdf
    • http://loaminoo.linkpc.net/1091090090094091/Women-at-Work-The-Transformation-of-Work-and-Community-in-Lowell-Massachusetts-1826-1860-by-Thomas-Dublin.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.