Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa4ccf936017929f…

MALICIOUS

PDF

16.3 KB Created: 2019-04-30 18:15:06 +01:00 Authoring application: mPDF 5.7
MD5: 605425964e0d3ad67d8b5549e70260f1 SHA-1: 1119d7d81f5c358d7eee75338471349d02a352bb SHA-256: fa4ccf936017929fdad96dccab430294cc49038f6caad5a100255b0298446a37
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a link farm. The primary heuristic indicates this is a critical finding, suggesting the PDF's purpose is to direct users to external resources. While no scripts were extracted, the sheer volume of links points towards a malicious intent, possibly for SEO spam or to distribute further malware. The URLs themselves are the main IOCs.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090094090093095/Balancer-Advent-Mage-Cycle-4-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/1090094091093094/Magus-Advent-Mage-Cycle-2-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/4097097097098091/Jaunten-Advent-Mage-Cycle-1-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/1090092099096093/Heroes-A-Raconteur-House-Anthology-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/1090094090098099/Special-Forces-01-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/1090090097091099/Arrows-of-Promise-Kingmakers-2-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/1090093091099096/The-Child-Prince-The-Artifactor-1-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/1090098093099099/The-Child-Prince-The-Artifactor-1-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/3097090093095098/The-Death-Gate-Cycle-Novels-The-Death-Gate-Cycle-Into-the-Labyrinth-the-Hand-of-Chaos-Dragon-Wing-Serpent-Mage-the-Seventh-Gate-Fire-Sea-by-Books-LLC.pdf
    • http://loaminoo.linkpc.net/5094096094096/Serpent-Mage-The-Death-Gate-Cycle-4-by-Margaret-Weis.pdf
    • http://loaminoo.linkpc.net/3094094099090096/Return-to-Honor-Powder-Mage-1-5-by-Brian-McClellan.pdf
    • http://loaminoo.linkpc.net/1090092098092092/Deepwoods-Deepwoods-Saga-1-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/1090090093095099/Origins-A-Deepwoods-Book---A-Collection-of-Deepwoods-Short-Stories-Deepwoods-Series-0-by-Honor-Raconteur.pdf
    • http://loaminoo.linkpc.net/9098097098095097/Advent-Advent-alles-b-rennt-by-Steve-Airstone.pdf
    • http://loaminoo.linkpc.net/9098097098096090/Advent-Advent-die-Mama-rennt-by-Anke-Wolff.pdf
    • http://loaminoo.linkpc.net/3099099090093090/Advent-Advent-Trilogy-1-by-James-Treadwell.pdf
    • http://loaminoo.linkpc.net/1093095091092094/Advent-Advent-Trilogy-1-by-James-Treadwell.pdf
    • http://loaminoo.linkpc.net/3097092099092096/The-Silver-Mage-Deverry-15-The-Dragon-Mage-7-by-Katharine-Kerr.pdf
    • http://loaminoo.linkpc.net/3096097097096097/The-Mage-Mage-Sequence-1-by-Jim-Farris.pdf
    • http://loaminoo.linkpc.net/2092097097095096/Cycle-of-Rice-Cycle-of-Life-A-Story-of-Sustainable-Farming-by-Jan-Reynolds.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.