Malicious PDF — malware analysis report

Static analysis result for SHA-256 775f1ec8d3810926…

MALICIOUS

PDF

11.6 KB Created: 2015-07-15 14:37:13 +04:00 Authoring application: DOMPDF
MD5: 426699a66f509a11355d4cee573f6574 SHA-1: 347dc3dd61b878b94cd8545569c8e2d77659354a SHA-256: 775f1ec8d3810926791626fcb04164126f0a4c3c7cb6af94582429efeb6cb95b
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO manipulation tactic. The ML classifier also flagged the PDF as malicious. While no scripts were extracted, the embedded URLs and the heuristic findings indicate a likely attempt to redirect users to potentially malicious websites, possibly for further exploitation or to host malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=1103.1&wehsa=1&pdf=1103
    • http://www.faceausoleil.com/index.php?article=1636.2&ipbvv=2&pdf=1636
    • http://krummenacher-haustechnik.ch/index.php?article=1028.1&ptfan=1&pdf=1028
    • http://photo-file.ru/index.php?article=2482.1&wehsa=1&pdf=2482
    • http://hillcrestchurch.info/index.php?article=2185.1&jhrre=1&pdf=2185
    • http://photo-file.ru/index.php?article=1102.1&wehsa=1&pdf=1102
    • http://www.mantrabeautybar.ca/index.php?article=1376.1&rukbv=1&pdf=1376
    • http://trans-cultures.eu/index.php?article=2049.1&asedt=1&pdf=2049
    • http://egliseviechretienne.com/index.php?article=2082.5&fkyfd=5&pdf=2082
    • http://photo-file.ru/index.php?article=500.1&wehsa=1&pdf=500
    • http://photo-file.ru/index.php?article=1472.1&wehsa=1&pdf=1472
    • http://photo-file.ru/index.php?article=508.1&wehsa=1&pdf=508
    • http://www.wallart.com.es/index.php?article=1074.1&dxunj=1&pdf=1074
    • http://photo-file.ru/index.php?article=2274.1&wehsa=1&pdf=2274
    • http://riddlet.com/index.php?article=2023.2&bxiuo=2&pdf=2023
    • http://photo-file.ru/index.php?article=1991.1&wehsa=1&pdf=1991
    • http://www.otomatmarket.com.tr/index.php?article=1463.1&vbepn=1&pdf=1463

Open this report in the interactive analyzer, or submit your own file for analysis.