Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e32ac6cd0f8438a…

MALICIOUS

PDF

12.1 KB Created: 2015-07-15 16:23:28 +04:00 Authoring application: DOMPDF
MD5: bc038fa4ec2b55ed60ce34da6f43c4e9 SHA-1: 87c54a43a1716967b47e8f0eb6e1355c822c2ef6 SHA-256: 3e32ac6cd0f8438a93eeb585fec163750965237dba90ea5b1c670cb2d6a9f74a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded URLs pointing to various websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The document body contains text related to 'Binary options review 2015 broker scams' and includes many of the same URLs, suggesting a lure to potentially fraudulent or malicious websites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chavagnes.com/index.php?article=786.2&urwbo=2&pdf=786
    • http://serviferias.org/index.php?article=282.2&daalr=2&pdf=282
    • http://www.mantrabeautybar.ca/index.php?article=138.1&rukbv=1&pdf=138
    • http://chavagnes.com/index.php?article=1790.2&urwbo=2&pdf=1790
    • http://www.amenagementboislyon.com/index.php?article=1280.1&jnfas=1&pdf=1280
    • http://chavagnes.com/index.php?article=2490.2&urwbo=2&pdf=2490
    • http://wbus.nl/index.php?article=944.7&exicf=7&pdf=944
    • http://heathervincentlandscapes.com.au/index.php?article=605.1&bsylx=1&pdf=605
    • http://pamojaexpeditions.com/index.php?article=2074.2&lqpte=2&pdf=2074
    • http://chavagnes.com/index.php?article=200.2&urwbo=2&pdf=200
    • http://chavagnes.com/index.php?article=2438.2&urwbo=2&pdf=2438
    • http://chavagnes.com/index.php?article=2290.2&urwbo=2&pdf=2290
    • http://sandystraitssizzlers.com/index.php?article=1862.1&kwbat=1&pdf=1862
    • http://chavagnes.com/index.php?article=2079.2&urwbo=2&pdf=2079
    • http://websitedesignindelhi.co.in/index.php?article=2462.1&uoohx=1&pdf=2462
    • http://chavagnes.com/index.php?article=1125.2&urwbo=2&pdf=1125
    • http://camus-sarl.fr/index.php?article=1237.2&fnxpz=2&pdf=1237

Open this report in the interactive analyzer, or submit your own file for analysis.