PDF malware analysis — malicious · 8427e2b43c7ff70c

MALICIOUS

PDF

4.7 KB Created: 2015-06-03 16:38:50 +03:00 Authoring application: DOMPDF

MD5: c7679668999fddf93de3049603467d77 SHA-1: a00ab5c54ce039195c8668395ad40d9fc3cfd2f1 SHA-256: 8427e2b43c7ff70c962c5c3140b8c4bfe4dff4cbc31ddb334a342c349db3707e

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. The document body, while truncated, also contains these URLs and text related to stock trading and financial markets, suggesting a lure to financial-themed content. The primary goal appears to be directing users to a network of external websites, likely for SEO manipulation or to host further malicious content.

Machine Learning

Nyx PDF Classifier clean score 0.1457

Heuristics 2

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.prequine.com/index.php?2015/torcida.pdf&fcldj=1&aspx=1278
- http://www.nibl.co.nz/index.php?2015/decision.pdf&angzv=1&aspx=558
- http://www.nibl.co.nz/index.php?2015/decision.pdf&angzv=1&aspx=1671
- http://www.nibl.co.nz/index.php?2015/decision.pdf&angzv=1&aspx=1049
- http://www.prequine.com/index.php?2015/torcida.pdf&fcldj=1&aspx=838
- http://dyrlaegecentret.dk/index.php?2015/typestitch.pdf&hjhle=1&aspx=sitemap

Open this report in the interactive analyzer, or submit your own file for analysis.