Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdda0f19085b3229…

MALICIOUS

PDF

15.8 KB Created: 2019-05-02 17:17:01 +01:00 Authoring application: mPDF 5.7
MD5: 508708787588a6fced0f6e04d09e716f SHA-1: 321005eb64c7ad98859f1d7ad67c9f69496d05c1 SHA-256: fdda0f19085b3229146a819350349a848c1b80da1c8874e9706fcb9faa0150ae
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents on the domain loaminoo.linkpc.net. This is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. While the URLs themselves are marked as confirmed benign, the sheer volume and the heuristic firing of 'PDF_SEO_LINK_FARM' suggest a malicious intent to redirect users to potentially harmful content or to game search engine rankings. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/3091097090099091/You-re-Busting-My-Nuptials-by-Ann-Everett.pdf
    • http://loaminoo.linkpc.net/1097098095097/The-Pagan-Nuptials-of-Julia-And-Other-Stories-by-Keith-Henderson.pdf
    • http://loaminoo.linkpc.net/3098097097098091/Space-Bride-Galactic-Nuptials-1-by-Missy-Martine.pdf
    • http://loaminoo.linkpc.net/5096092091090090/Cloud-Busting-by-Malorie-Blackman.pdf
    • http://loaminoo.linkpc.net/1091093099097092097/Wilderness-Journals-of-Everett-Ruess-by-Everett-Ruess.pdf
    • http://loaminoo.linkpc.net/1091092095094094/They-All-Love-Jack-Busting-the-Ripper-by-Bruce-Robinson.pdf
    • http://loaminoo.linkpc.net/2092096095097092/Busting-Your-Corporate-Idol-Self-Help-for-the-Chronically-Overworked-by-Greg-Marcus.pdf
    • http://loaminoo.linkpc.net/1091095093096090095/Poisoned-How-a-Crime-Busting-Prosecutor-Turned-His-Medical-Mystery-into-a-Crusade-for-Environmental-Victims-by-Alan-Bell.pdf
    • http://loaminoo.linkpc.net/9099094099098090/The-Sixth-Chalice-Busting-Ghosts-the-Jewish-Way-Book-1-of-The-Bar-Tahara-Series-Fantasy-thrillers-of-a-new-kind-by-Eran-Solomon.pdf
    • http://loaminoo.linkpc.net/4090093097092093/I-Loved-That-About-Her-by-C-R-Everett.pdf
    • http://loaminoo.linkpc.net/3096098091099090/The-Mighty-T-by-Everett-Powers.pdf
    • http://loaminoo.linkpc.net/4091099099092094/God-s-Country-by-Percival-Everett.pdf
    • http://loaminoo.linkpc.net/4090099096095094/Two-if-By-Sea-by-Leonard-Everett-Fisher.pdf
    • http://loaminoo.linkpc.net/3095090094092092/Wounded-by-Percival-Everett.pdf
    • http://loaminoo.linkpc.net/5090093090090096/Erasure-by-Percival-Everett.pdf
    • http://loaminoo.linkpc.net/2090095092095099/1-1-Jihad-Britain-by-Jack-Everett.pdf
    • http://loaminoo.linkpc.net/3092097096093091/A-Tryst-with-Trouble-by-Alyssa-Everett.pdf
    • http://loaminoo.linkpc.net/3090096095095097/Dark-Passions-by-Elixa-Everett.pdf
    • http://loaminoo.linkpc.net/1091093099097099095/Death-on-Alder-by-Beth-Everett.pdf
    • http://loaminoo.linkpc.net/2090096095096095/The-Faces-of-Immortality-by-Everett-Coles.pdf
    • http://loaminoo.linkpc.net/9099094099098090/The-Sixth-Chalice-Busting-Ghosts-the-Jewish-Way-Book-1-of-The-

Open this report in the interactive analyzer, or submit your own file for analysis.