Malicious PDF — malware analysis report

Static analysis result for SHA-256 94869d0db0e6d0eb…

MALICIOUS

PDF

6.6 KB Created: 2015-06-04 18:32:57 +04:00 Authoring application: DOMPDF First seen: 2015-06-09
MD5: 42086bfb43969e1ab701903bd0381e99 SHA-1: e39be659eadf85a683584489adbd35570e4be2ed SHA-256: 94869d0db0e6d0eb89419206b006bd38ebb8d71c88f81408633e9860fa581483
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains multiple embedded URLs that are all related to binary options trading. The ML classifier also flagged this PDF as malicious. The document body, though truncated, reinforces the theme of trading and investment opportunities. The primary attack vector appears to be luring the user to click on these external links, which likely lead to fraudulent or phishing websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5488

Heuristics 2

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://canyoncoal.com/index.php?wiki/04/06/2015/serendibleisure/binary+option+application.pdf&tteow=1&news=1504 In PDF document text
    • http://www.plzenska-knihvazba.cz/index.php?wiki/04/06/2015/newsley/binary+option+handel.pdf&oljvs=2&news=2058In PDF document text
    • http://silchef.com/index.php?wiki/04/06/2015/techgadgetsin/binary+option+8+bullet.pdf&qbvag=1&news=751In PDF document text
    • http://wedesignitall.com/index.php?wiki/04/06/2015/boston/mobile+binary+options.pdf&efbqu=1&news=1670In PDF document text
    • http://websolutions.sg/index.php?wiki/04/06/2015/radiozuid/binary+options+broker+review.pdf&kbwax=1&news=1069In PDF document text
    • http://highlandsmommies.org/index.php?wiki/04/06/2015/degusto/binary+option+system+j25.pdf&qejwh=3&news=1851In PDF document text
    • http://www.supermaraton.eu/index.php?wiki/04/06/2015/housepop/binaryoptionstradingguide.com.pdf&owutp=1&news=sitemapIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.