Malicious PDF — malware analysis report

Static analysis result for SHA-256 956048b98d5f5ad8…

MALICIOUS

PDF

12.9 KB Created: 2015-07-15 16:25:10 +04:00 Authoring application: DOMPDF
MD5: 2d34706814166b2545c6da7e85ebea63 SHA-1: 2c667ad2a9ad02898034165d81fbd77dd3faaf6e SHA-256: 956048b98d5f5ad82b9e9d14effdde0123dc64b451ff719541419b755a8c36c8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier and contains a significant number of embedded URLs, indicative of a link farm or SEO poisoning attack. The document body contains text related to 'Binary options gambling real', suggesting a lure to financial scams. No scripts were extracted, but the sheer volume of external links points to a malicious intent to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8856

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chavagnes.com/index.php?article=742.2&urwbo=2&pdf=742
    • http://unibindsport.no/index.php?article=1517.1&ufueq=1&pdf=1517
    • http://zamca.ro/index.php?article=2063.1&jxoor=1&pdf=2063
    • http://chavagnes.com/index.php?article=1426.2&urwbo=2&pdf=1426
    • http://les-zephyrs.com/index.php?article=2130.2&ylevy=2&pdf=2130
    • http://chavagnes.com/index.php?article=1885.2&urwbo=2&pdf=1885
    • http://fotosalon-zoom.ru/index.php?article=1868.4&sufyu=4&pdf=1868
    • http://www.mantrabeautybar.ca/index.php?article=349.1&rukbv=1&pdf=349
    • http://phillipsandcoinc.com/index.php?article=811.1&sxlyu=1&pdf=811
    • http://chavagnes.com/index.php?article=1770.2&urwbo=2&pdf=1770
    • http://chavagnes.com/index.php?article=1658.2&urwbo=2&pdf=1658
    • http://chavagnes.com/index.php?article=2384.2&urwbo=2&pdf=2384
    • http://kontraportal.com/index.php?article=2007.1&szjdf=1&pdf=2007
    • http://chavagnes.com/index.php?article=1251.2&urwbo=2&pdf=1251
    • http://hotrodderclassifieds.com/index.php?article=391.1&hjjgr=1&pdf=391
    • http://chavagnes.com/index.php?article=32.2&urwbo=2&pdf=32
    • http://www.otomatmarket.com.tr/index.php?article=1893.1&vbepn=1&pdf=1893

Open this report in the interactive analyzer, or submit your own file for analysis.