Malicious PDF — malware analysis report

Static analysis result for SHA-256 2fd023c4f01dd663…

MALICIOUS

PDF

12.6 KB Created: 2015-07-14 19:48:12 +03:00 Authoring application: DOMPDF
MD5: 05f208e4966dbaa81106a6ee75a4be79 SHA-1: b5a656ec693cc514f0db8b4626b0a0ef72e9e761 SHA-256: 2fd023c4f01dd663ec14c8109ac7e5ff2dc7bacc4b41756cda6c5cf31ae623bc
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by a machine learning classifier and contains a large number of embedded links, indicating a link farm or SEO poisoning attempt. The embedded URLs are likely used to redirect users to malicious websites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8883

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cmpartners.com.au/index.php?article=1907.1&vhbyw=1&pdf=1907
    • http://brightconstructiongroup.com/index.php?article=1154.2&brsjy=2&pdf=1154
    • http://worldmachinery.co.in/index.php?article=2252.2&ihvdy=2&pdf=2252
    • http://www.cmpartners.com.au/index.php?article=1383.1&vhbyw=1&pdf=1383
    • http://mk-vlg.com/index.php?article=1636.4&cenxk=4&pdf=1636
    • http://www.cmpartners.com.au/index.php?article=1994.1&vhbyw=1&pdf=1994
    • http://transferpapir.no/index.php?article=1749.2&lqebo=2&pdf=1749
    • http://www.tamayouz.net/index.php?article=223.1&vexwv=1&pdf=223
    • http://unifiedmagik.com/index.php?article=2486.1&dlnya=1&pdf=2486
    • http://www.cmpartners.com.au/index.php?article=1751.1&vhbyw=1&pdf=1751
    • http://www.cmpartners.com.au/index.php?article=1367.1&vhbyw=1&pdf=1367
    • http://www.cmpartners.com.au/index.php?article=2033.1&vhbyw=1&pdf=2033
    • http://deluxe.mallorca-property.biz/index.php?article=2441.2&ivxei=2&pdf=2441
    • http://www.cmpartners.com.au/index.php?article=14.1&vhbyw=1&pdf=14
    • http://mqasociados.com.ar/index.php?article=1861.2&defzu=2&pdf=1861
    • http://www.cmpartners.com.au/index.php?article=9.1&vhbyw=1&pdf=9
    • http://www.enakcami.com/index.php?article=1449.3&thoit=3&pdf=1449

Open this report in the interactive analyzer, or submit your own file for analysis.