Malicious PDF — malware analysis report

Static analysis result for SHA-256 08647929228cb7c2…

MALICIOUS

PDF

6.7 KB Created: 2015-06-04 18:29:53 +04:00 Authoring application: DOMPDF First seen: 2015-06-09
MD5: 8724002ff12713a875f4aa77c920855f SHA-1: 5489ad43d5002df992183aee75e21b81b52adb84 SHA-256: 08647929228cb7c271dfda90a6bf03bba2d4033e381248e1aedd6cd56bc81d1b
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs that are likely part of an SEO spam campaign, directing users to websites discussing binary options. The heuristic 'PDF_SEO_PHP_GATEWAY_LINK_FARM' confirms this, indicating a high number of distinct hosts and links. While no scripts were extracted, the embedded URLs themselves serve as the primary indicators of malicious intent, likely to drive traffic or potentially lead to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5034

Heuristics 2

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://canyoncoal.com/index.php?wiki/04/06/2015/serendibleisure/binary+option+application.pdf&tteow=1&news=1956 In PDF document text
    • http://wigginton.co.uk/index.php?wiki/04/06/2015/webblue/binary+option+robot+1.0.pdf&gzsns=2&news=65In PDF document text
    • http://www.masqueplacer.es/index.php?wiki/04/06/2015/bepgasdanang/binary+option+broker+in+uk.pdf&yhlgy=1&news=1656In PDF document text
    • http://www.bluematters.be/index.php?wiki/04/06/2015/celebnetworth/binary+options+u+s+based.pdf&jjvup=1&news=1784In PDF document text
    • http://smart-retail.es/index.php?wiki/04/06/2015/golfasia/24+binary+options.pdf&fnkkl=1&news=700In PDF document text
    • http://futureu.com.ua/index.php?wiki/04/06/2015/elbaixcat/binary+option+yahoo.pdf&aiaey=1&news=851In PDF document text
    • http://www.supermaraton.eu/index.php?wiki/04/06/2015/housepop/binaryoptionstradingguide.com.pdf&owutp=1&news=sitemapIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.