Malicious PDF — malware analysis report

Static analysis result for SHA-256 086f11bda3cbd220…

MALICIOUS

PDF

6.4 KB Created: 2015-06-20 00:14:42 +04:00 Authoring application: DOMPDF First seen: 2015-06-23
MD5: 10542c64ab859d61d7ff749f934fe9e4 SHA-1: 034bf7f79fccf73cd3e2564056aa2a620cce689f SHA-256: 086f11bda3cbd220eeeaadb3d1e18cb6202e7b95c651228a0ddea8a78dc40b9e
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and text designed to impersonate legitimate banking communications, specifically referencing payment and bank details. The heuristic 'SE_PAYMENT_REDIRECT_LURE' strongly indicates a business email compromise tactic. While no scripts were extracted, the presence of numerous SEO-spam links suggests a broader campaign to distribute malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier clean score 0.1458

Heuristics 3

  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://edenrose.com.au/index.php?news/2015/bankers-discount-meaning/nigerian-banking-regulations.pdf&gvjtt=2&bank=2359 In PDF document text
    • http://www.planet-carpe.com/index.php?news/2015/bank-recruitment-2014/firstbank-mobile-banking.pdf&iuygn=4&bank=2326In PDF document text
    • http://phcccolorado.org/index.php?news/2015/harris-bank-deals/investment-banking-xtranormal.pdf&fjhls=4&bank=2157In PDF document text
    • http://www.thetravelingimage.com/index.php?news/2015/citibank-global-atms/dutch-development-bank.pdf&bvrkb=9&bank=2359In PDF document text
    • http://www.grantmarketing.com/index.php?news/2015/indian-banking-regulations/ally-bank-savings.pdf&crrxl=6&bank=845In PDF document text
    • http://www.rqubes.com/index.php?news/2015/ubank-valuation/vietnam-bank-deposits.pdf&hvesh=5&bank=1958In PDF document text
    • http://wigginton.co.uk/index.php?news/2015/citibank-philadelphia-branches/bank-number-canada.pdf&sjywo=3&bank=2141In PDF document text
    • http://janesmithagency.com/index.php?news/2015/cit-bank-cds/maha-bank-website.pdf&allsz=7&bank=sitemapIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.