Malicious PDF — malware analysis report

Static analysis result for SHA-256 fef417a3fc619a09…

MALICIOUS

PDF

17.0 KB Created: 2019-05-02 02:25:25 +01:00 Authoring application: mPDF 5.7
MD5: 8fb57bdb0366b82dc42de5331c1efbab SHA-1: b97ef3afa7e6ea5e9dbeaca594910555a7bc0008 SHA-256: fef417a3fc619a09df5459cb1b15ef779c6b69f29667c381cdc20654963708a1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The critical PDF_SEO_LINK_FARM heuristic indicates that this PDF contains a large number of external links, likely for SEO manipulation or as a distribution vector. While the document body was not readable, the presence of numerous links to PDF files hosted on 'loaminoo.linkpc.net' suggests a link farm or content distribution scheme. No scripts were extracted from this sample. The attack pattern is inferred from the link farm heuristic.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/7092094090093096/The-Annotated-Treasure-Island-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/1090095096097093092/Treasure-Island-The-Classic-Collection-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/6099098095090094/The-Master-of-Ballantrae-Treasure-Island-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/5092093096090095/The-Spitting-Image-Treasure-Island-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/7092091097095096/Treasure-Island-The-Original-Illustrated-Version-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/5096099093092099/Treasure-Island-A-Story-of-the-Spanish-Main-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/5099092096095091/Treasure-Island---Special-Student-Edition-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/5095099094099090/Luke-Evans-Reads-Treasure-Island-Famous-Fiction-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/6099098095090099/Treasure-island-Kidnapped-Weir-of-Hermiston-The-master-of-Ballantrae-The-black-arrow-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/6098090091095090/L-le-au-Tr-sor-Treasure-Island-Bilingue-Collection-RLS-Bilingue-t-7-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/1091092096097090098/The-Master-of-Ballantrae-by-Robert-Louis-Stevenson-Unabridged-1889-Original-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/1090096098091091094/Kidnapped-By-Robert-Louis-Stevenson-Illustrated-FREE-Gulliver-s-Travels-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/6099098095091091/The-Master-of-Ballantrae-Robert-Louis-Stevenson-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/9091091099091094/The-Bottle-Imp-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/9099099092091098/Kidnapped-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/1098092098092090/Kidnapped-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/2099099093096099/The-Bottle-Imp-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/9098093099093091/The-Wrong-Box-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/3095098093098092/Kidnapped-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/4097094090098093/South-Sea-Tales-by-Robert-Louis-Stevenson.pdf
    • http://loaminoo.linkpc.net/6099098095090099/Treasur

Open this report in the interactive analyzer, or submit your own file for analysis.