Malicious PDF — malware analysis report

Static analysis result for SHA-256 424060e5568e61c1…

MALICIOUS

PDF

11.6 KB Created: 2015-07-15 14:39:47 +04:00 Authoring application: DOMPDF
MD5: ebd4ae0b06dbb078faafa4b24cea39ce SHA-1: 376fa43788ece4f86989e1ab8b73482a87c4e094 SHA-256: 424060e5568e61c1f260993221af14b43866997a965a7458f089d042fdb52eaf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing Link

The PDF file was flagged by a machine learning classifier and contains a large number of embedded URLs, indicating a link farm designed to direct users to potentially malicious external sites. The heuristic 'PDF_SEO_LINK_FARM' specifically calls out the mass external PDF link farm, with the first URL being http://photo-file.ru/index.php?article=568.1&wehsa=1&pdf=568. This suggests a phishing or malware distribution campaign leveraging SEO techniques to disguise malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9282

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=568.1&wehsa=1&pdf=568
    • http://fotosalon-zoom.ru/index.php?article=257.4&sufyu=4&pdf=257
    • http://ingresoindonesia.com/index.php?article=2044.1&riycz=1&pdf=2044
    • http://photo-file.ru/index.php?article=1543.1&wehsa=1&pdf=1543
    • http://trans-cultures.eu/index.php?article=1518.1&asedt=1&pdf=1518
    • http://photo-file.ru/index.php?article=2388.1&wehsa=1&pdf=2388
    • http://gonencelik.com.tr/index.php?article=829.1&aosqe=1&pdf=829
    • http://vioval.eu/index.php?article=1391.1&irrir=1&pdf=1391
    • http://dhyansuman.com/index.php?article=570.8&xvanh=8&pdf=570
    • http://photo-file.ru/index.php?article=1697.1&wehsa=1&pdf=1697
    • http://photo-file.ru/index.php?article=1836.1&wehsa=1&pdf=1836
    • http://photo-file.ru/index.php?article=299.1&wehsa=1&pdf=299
    • http://dfnotebooks.com.br/index.php?article=346.1&gatis=1&pdf=346
    • http://photo-file.ru/index.php?article=1881.1&wehsa=1&pdf=1881
    • http://howtoexcelinlife.com/index.php?article=2276.1&ytcwy=1&pdf=2276
    • http://amicosmeceutici.it/index.php?article=561.1&replv=1&pdf=561

Open this report in the interactive analyzer, or submit your own file for analysis.