PDF malware analysis — malicious · 1c2e7322f959576d

MALICIOUS

PDF

5.0 KB Created: 2015-06-03 16:38:27 +03:00 Authoring application: DOMPDF

MD5: 059f91105b6b80bc07b4253f416d9b17 SHA-1: 97a467f59cb718aca2364e23e194e56c26413e7d SHA-256: 1c2e7322f959576d90c8706e69cc785c6102ac91722d1b65e5c264cc6838e48d

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF was generated by DOMPDF and contains a significant number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs are presented within text discussing stock market trading, suggesting a lure to attract users to potentially malicious or spam content. No scripts were extracted from this sample, limiting further analysis of its behavior.

Machine Learning

Nyx PDF Classifier clean score 0.1330

Heuristics 2

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.nibl.co.nz/index.php?2015/decision.pdf&angzv=1&aspx=182
- http://www.academiafutebolangola.com/index.php?2015/hmdeepfocus.pdf&audtr=1&aspx=1083
- http://www.nibl.co.nz/index.php?2015/decision.pdf&angzv=1&aspx=586
- http://www.academiafutebolangola.com/index.php?2015/hmdeepfocus.pdf&audtr=1&aspx=1489
- http://www.academiafutebolangola.com/index.php?2015/hmdeepfocus.pdf&audtr=1&aspx=37
- http://dyrlaegecentret.dk/index.php?2015/typestitch.pdf&hjhle=1&aspx=sitemap

Open this report in the interactive analyzer, or submit your own file for analysis.