Malicious PDF — malware analysis report

Static analysis result for SHA-256 ffb2d63405c05d43…

MALICIOUS

PDF

18.7 KB Created: 2019-05-03 06:42:05 +01:00 Authoring application: mPDF 5.7
MD5: 5fa50b812529259522bc4915313685b6 SHA-1: f05c6f6d6cc183c3c8ea010e942f2d1f15b1678b SHA-256: ffb2d63405c05d43bdd1f63f97ab6775103d1140d6d077cbfad65268148e4162
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links pointing to external PDF documents hosted on the domain 'loaminoo.linkpc.net'. This pattern is indicative of a link farm or SEO poisoning technique, likely intended to drive traffic or distribute further malicious content. No scripts were extracted from this sample, and the document body was unreadable.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1091094098092092095/Listening-in-Action-by-Michael-Rost.pdf
    • http://loaminoo.linkpc.net/9098095092097094/Nature-From-Within-Gustav-Theodor-Fechner-And-His-Psychophysical-Worldview-by-Michael-Heidelberger.pdf
    • http://loaminoo.linkpc.net/1091094098092096099/Works-ed-by-E-R-Rost-Works-ed-by-E-R-Rost-by-Horace-Hayman-Wilson.pdf
    • http://loaminoo.linkpc.net/4099098091095093/Encountering-Naturalism-A-Worldview-And-Its-Uses-by-Thomas-W-Clark.pdf
    • http://loaminoo.linkpc.net/5099094098094094/Naming-the-Elephant-Worldview-as-a-Concept-by-James-W-Sire.pdf
    • http://loaminoo.linkpc.net/1091094098091094093/Berlin-By-ROST-by-Scott-Alexander.pdf
    • http://loaminoo.linkpc.net/2097094097097098/Life-at-the-Bottom-The-Worldview-that-Makes-the-Underclass-by-Theodore-Dalrymple.pdf
    • http://loaminoo.linkpc.net/2097092093090093/The-Universe-Next-Door-A-Basic-Worldview-Catalog-by-James-W-Sire.pdf
    • http://loaminoo.linkpc.net/7090092092097/Life-at-the-Bottom-The-Worldview-That-Makes-the-Underclass-by-Theodore-Dalrymple.pdf
    • http://loaminoo.linkpc.net/9095098099097/Life-at-the-Bottom-The-Worldview-That-Makes-the-Underclass-by-Theodore-Dalrymple.pdf
    • http://loaminoo.linkpc.net/2097090094093090/One-Of-the-Few-A-Marine-Fighter-Pilot-s-Reconnaissance-of-the-Christian-Worldview-by-Jason-B-Ladd.pdf
    • http://loaminoo.linkpc.net/3093091090091090/The-Chronicles-of-Narnia-and-Philosophy-The-Lion-the-Witch-and-the-Worldview-by-Gregory-Bassham.pdf
    • http://loaminoo.linkpc.net/1091094098091099096/Ondskans-R-st-Krewe-of-Hunters-5-by-Heather-Graham.pdf
    • http://loaminoo.linkpc.net/1091094098090097096/The-Whistleblower-Confessions-of-a-Healthcare-Hitman-by-Peter-Rost.pdf
    • http://loaminoo.linkpc.net/1091094098090097092/Zuhoren-und-Instruktion-Shopaholic-and-Sister-by-Detlef-H-Rost.pdf
    • http://loaminoo.linkpc.net/1091094098092098095/Kyrgyzy-Rost-Natsional-nogo-Samosoznaniia-by-A-A-Asankanov.pdf
    • http://loaminoo.linkpc.net/6095090091091090/Vassili-Zaitsev-Hero-Of-The-Soviet-Union-by-MST-William-A-Rost.pdf
    • http://loaminoo.linkpc.net/1091094098092099091/The-Complete-Idiot-s-Guide-to-Microsoft-Excel-2010-2-In-1-by-Richard-Rost.pdf
    • http://loaminoo.linkpc.net/1091094098092092096/The-Dark-Side-of-Software-Engineering-Evil-on-Computing-Projects-by-Johann-Rost.pdf
    • http://loaminoo.linkpc.net/1091094098092091092/Relieving-Pelvic-Pain-During-and-After-Pregnancy-How-Women-Can-Heal-Chronic-Pelvic-Instability-by-Cecile-Rost.pdf
    • http://loaminoo.linkpc.net/2097092093090093/The-Universe-Next-Door-A-Basic-Worldview-Catalog-by-J

Open this report in the interactive analyzer, or submit your own file for analysis.