PDF static analysis report

Static analysis result for SHA-256 86d1d121730678bd…

SUSPICIOUS

PDF

6.1 KB Created: 2015-06-19 22:59:00 +04:00 Authoring application: DOMPDF First seen: 2015-06-23
MD5: 1e70686605b3b83ba281e2dc878fb690 SHA-1: fbf517f7a29cf3de938326eb48414b2d6f068e97 SHA-256: 86d1d121730678bdcfef69729fd2d637d26dee4b59fab00c3d984e9c6f0ade4a
32 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.1550

Heuristics 2

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.smeadvisor.com/index.php?news/2015/nigerian-banking-jobs/paypal-ally-bank.pdf&auwrb=7&bank=591 In PDF document text
    • http://momentdor.com/index.php?news/2015/preferred-banking-wiki/citizens-bank-promotions.pdf&wtkxr=5&bank=1416In PDF document text
    • http://melrosemountainbike.com/index.php?news/2015/100-citibank-dr/new-ubank-site.pdf&zqtqg=6&bank=1745In PDF document text
    • http://ogrome.com/index.php?news/2015/citibank-escrow-account/international-banks-definition.pdf&hjuog=4&bank=1237In PDF document text
    • http://paleo4you.nl/index.php?news/2015/completely-online-banks/kartu-atm-commbank.pdf&ksrdt=4&bank=2246In PDF document text
    • http://www.hedgesgalleryins.com/index.php?news/2015/usaver-ubank/safest-banks-australia.pdf&rhtxb=8&bank=958In PDF document text
    • http://phcccolorado.org/index.php?news/2015/harris-bank-deals/investment-banking-xtranormal.pdf&fjhls=4&bank=1390In PDF document text
    • http://graphitepayments.com/index.php?news/2015/banking-terms-mrunal/unemployment-citibank.pdf&uvhzq=26&bank=sitemapIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.