Malicious PDF — malware analysis report

Static analysis result for SHA-256 14f75adc00773f10…

MALICIOUS

PDF

7.1 KB Created: 2015-06-04 18:29:06 +04:00 Authoring application: DOMPDF First seen: 2015-06-09
MD5: 1e9b56cc069a336e2c771413b79ab85d SHA-1: badf9541cd57e6460abebe1bafb02dda03b8d5d3 SHA-256: 14f75adc00773f10a7c43541481973ce0c53cbb83de2970085a0e44c42fbbfb0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs that point to external websites, identified by the 'PDF_SEO_PHP_GATEWAY_LINK_FARM' heuristic. The document body also contains these URLs, suggesting the primary purpose is to drive traffic to these sites, likely for SEO spam or to host phishing content related to binary options trading. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6281

Heuristics 2

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.yakiscupcakes.com/index.php?wiki/04/06/2015/goldenwestcafe/binary+option+org.pdf&woeax=1&news=2617 In PDF document text
    • http://imaginecoms.es/index.php?wiki/04/06/2015/articlecell/5+dollar+binary+option.pdf&fgxuy=4&news=2469In PDF document text
    • http://gendoc.es/index.php?wiki/04/06/2015/ragherrie/binary+profit+code+review.pdf&bihig=1&news=2452In PDF document text
    • http://toplisty.sk/index.php?wiki/04/06/2015/pissmo/5+min+binary+options+trading+strategy.pdf&ypdts=1&news=1606In PDF document text
    • http://www.vanwillegenconsult.nl/index.php?wiki/04/06/2015/themefuse/binary+options+easy.pdf&oxhqf=1&news=1295In PDF document text
    • http://darerteqa.com/index.php?wiki/04/06/2015/plineks/binary+brokers+sites.pdf&ougyk=1&news=1344In PDF document text
    • http://www.supermaraton.eu/index.php?wiki/04/06/2015/housepop/binaryoptionstradingguide.com.pdf&owutp=1&news=sitemapIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.