Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b21cc78af0a478f…

MALICIOUS

PDF

13.6 KB Created: 2015-07-15 05:49:09 +04:00 Authoring application: DOMPDF
MD5: 5c5dd675c259c0bbc74157ef5a4302e8 SHA-1: 0b69bee1eee06b155e6df01a81bb973396e72dbf SHA-256: 5b21cc78af0a478f73f4d9b1090a532af7f949b7377c60e5e0dabe9499193b00
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, many pointing to domains associated with SEO link farming. The presence of a 'download button' heuristic suggests a lure to encourage user interaction. While no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a likely attempt to redirect users to malicious or SEO-manipulated content, potentially as part of a phishing or spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8846

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://primetimerecords.com/index.php?article=480.1&cvsqx=1&pdf=480
    • http://smu12.com/index.php?article=475.4&ezwhk=4&pdf=475
    • http://marche-espoir.org/index.php?article=526.6&xonvf=6&pdf=526
    • http://primetimerecords.com/index.php?article=1784.1&cvsqx=1&pdf=1784
    • http://fresh2death.com/index.php?article=1813.1&lzrlo=1&pdf=1813
    • http://primetimerecords.com/index.php?article=2359.1&cvsqx=1&pdf=2359
    • http://casarosso.com.tr/index.php?article=1925.1&gdggi=1&pdf=1925
    • http://www.mantrabeautybar.ca/index.php?article=1440.1&rukbv=1&pdf=1440
    • http://logimarket.com.tr/index.php?article=2075.1&ewcgf=1&pdf=2075
    • http://primetimerecords.com/index.php?article=864.1&cvsqx=1&pdf=864
    • http://primetimerecords.com/index.php?article=1983.1&cvsqx=1&pdf=1983
    • http://primetimerecords.com/index.php?article=1398.1&cvsqx=1&pdf=1398
    • http://information32.org/index.php?article=1355.1&ugibr=1&pdf=1355
    • http://primetimerecords.com/index.php?article=1923.1&cvsqx=1&pdf=1923
    • http://ura-sandoz.com/index.php?article=1735.1&nydkb=1&pdf=1735
    • http://primetimerecords.com/index.php?article=1039.1&cvsqx=1&pdf=1039
    • http://pamojaexpeditions.com/index.php?article=554.2&lqpte=2&pdf=554

Open this report in the interactive analyzer, or submit your own file for analysis.