Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ce1f395641401ba…

MALICIOUS

PDF

5.1 KB Created: 2015-06-03 16:39:39 +03:00 Authoring application: DOMPDF
MD5: 06246be7cabdaab6560577c514aba4f1 SHA-1: a035d8c2882d8463355652f57e00009c7851c00a SHA-256: 6ce1f395641401ba3faab9405c57e122452573d0be7d4df047c76b5b08b04bed
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links likely serve to manipulate search engine rankings or redirect users to potentially malicious websites. No scripts were extracted, but the presence of embedded URLs suggests a phishing or SEO spamming attack vector.

Machine Learning

  • Nyx PDF Classifier clean score 0.1330

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://phcccolorado.org/index.php?2015/arabtera.pdf&effpp=1&aspx=1184
    • http://www.prequine.com/index.php?2015/torcida.pdf&fcldj=1&aspx=306
    • http://www.nibl.co.nz/index.php?2015/decision.pdf&angzv=1&aspx=1752
    • http://www.prequine.com/index.php?2015/torcida.pdf&fcldj=1&aspx=1692
    • http://www.kbb-gesellschaft.de/index.php?2015/ergoarena.pdf&urggv=1&aspx=2192
    • http://dyrlaegecentret.dk/index.php?2015/typestitch.pdf&hjhle=1&aspx=sitemap

Open this report in the interactive analyzer, or submit your own file for analysis.