Malicious PDF — malware analysis report

Static analysis result for SHA-256 14af3e069900e349…

MALICIOUS

PDF

12.3 KB Created: 2015-07-16 22:08:49 +04:00 Authoring application: DOMPDF
MD5: 29d496c399c301fe65645504ff880f29 SHA-1: 23d4b4a18e082c456a3a7c72c8132ad64b348738 SHA-256: 14af3e069900e349f911ecae32297ba5c08282d564d8e168accf58bf6cf225cb
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, many of which point to domains that appear to be part of a link farm. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, suggesting a non-standard use of the PDF for SEO manipulation or to redirect users to potentially malicious content. The ML classifier also flagged the document as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8883

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=743.2&tpnxb=2&pdf=743
    • http://mudinside.it/index.php?article=117.2&ozinn=2&pdf=117
    • http://trans-cultures.eu/index.php?article=1554.2&fskpf=2&pdf=1554
    • http://photo-file.ru/index.php?article=1779.2&tpnxb=2&pdf=1779
    • http://yapi-yapi.com/index.php?article=2274.4&uiwvz=4&pdf=2274
    • http://photo-file.ru/index.php?article=339.2&tpnxb=2&pdf=339
    • http://egliseviechretienne.com/index.php?article=156.6&sztxt=6&pdf=156
    • http://marmoleraflores.com/index.php?article=1516.3&ngysu=3&pdf=1516
    • http://aksoynet.nl/index.php?article=233.3&qbekg=3&pdf=233
    • http://photo-file.ru/index.php?article=1343.2&tpnxb=2&pdf=1343
    • http://photo-file.ru/index.php?article=1102.2&tpnxb=2&pdf=1102
    • http://photo-file.ru/index.php?article=244.2&tpnxb=2&pdf=244
    • http://www.masajeschihuahua.com/index.php?article=989.1&buiip=1&pdf=989
    • http://photo-file.ru/index.php?article=829.2&tpnxb=2&pdf=829
    • http://rollermarathondijon.fr/index.php?article=189.3&tkcho=3&pdf=189
    • http://photo-file.ru/index.php?article=976.2&tpnxb=2&pdf=976
    • http://www.mantrabeautybar.ca/index.php?article=2090.2&chffj=2&pdf=2090

Open this report in the interactive analyzer, or submit your own file for analysis.