Malicious PDF — malware analysis report

Static analysis result for SHA-256 5537cefc9dc81e5a…

MALICIOUS

PDF

11.6 KB Created: 2015-07-15 16:25:55 +04:00 Authoring application: DOMPDF
MD5: e4e701366e36cbca8746240ca7d068d6 SHA-1: 53a5ce003ec6f7c6fd588c0959cf62736fc8f1be SHA-256: 5537cefc9dc81e5ab1bd52126fb229224ce2373e4fed572ab308ecc64e61164c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The document body contains text related to binary options trading, suggesting a potential lure for financial scams. The primary attack pattern involves redirecting users through numerous external links, likely for SEO poisoning or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chavagnes.com/index.php?article=1717.2&urwbo=2&pdf=1717
    • http://modart.com.tr/index.php?article=435.1&ykgew=1&pdf=435
    • http://camus-sarl.fr/index.php?article=1232.2&fnxpz=2&pdf=1232
    • http://chavagnes.com/index.php?article=644.2&urwbo=2&pdf=644
    • http://www.kingdomfaithchurch.org/index.php?article=721.1&fksac=1&pdf=721
    • http://chavagnes.com/index.php?article=1647.2&urwbo=2&pdf=1647
    • http://kredite-fuer-arbeitslose.net/index.php?article=1880.1&jhins=1&pdf=1880
    • http://marche-espoir.org/index.php?article=864.6&xonvf=6&pdf=864
    • http://www.mantrabeautybar.ca/index.php?article=1124.1&rukbv=1&pdf=1124
    • http://chavagnes.com/index.php?article=325.2&urwbo=2&pdf=325
    • http://chavagnes.com/index.php?article=2065.2&urwbo=2&pdf=2065
    • http://chavagnes.com/index.php?article=1397.2&urwbo=2&pdf=1397
    • http://brightworldinfotech.com/index.php?article=1665.1&qfqoh=1&pdf=1665
    • http://chavagnes.com/index.php?article=537.2&urwbo=2&pdf=537
    • http://egliseviechretienne.com/index.php?article=2120.5&fkyfd=5&pdf=2120
    • http://chavagnes.com/index.php?article=2147.2&urwbo=2&pdf=2147
    • http://sestramaca.hr/index.php?article=80.3&jjcxv=3&pdf=80

Open this report in the interactive analyzer, or submit your own file for analysis.