Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a98e5bdc908c028…

MALICIOUS

PDF

12.2 KB Created: 2015-07-15 05:50:54 +04:00 Authoring application: DOMPDF
MD5: f2618169cd614e000a6b10b19d78ee61 SHA-1: 103318a6b2fc26e57a54f08be9b90fedc74d96d7 SHA-256: 9a98e5bdc908c02863871840f54714026d35031fbbefff83cbc9745808386456
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a large number of external links, characteristic of a link farm. The embedded URLs are designed to direct users to various websites, potentially for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted, and the document body contained mostly obfuscated data and the URLs themselves.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8995

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://primetimerecords.com/index.php?article=2131.1&cvsqx=1&pdf=2131
    • http://www.mantrabeautybar.ca/index.php?article=725.1&rukbv=1&pdf=725
    • http://www.cauzionealbogestoriambientali.it/index.php?article=1515.1&urrpv=1&pdf=1515
    • http://primetimerecords.com/index.php?article=1872.1&cvsqx=1&pdf=1872
    • http://stylereaction.com/index.php?article=185.1&fipzp=1&pdf=185
    • http://primetimerecords.com/index.php?article=2179.1&cvsqx=1&pdf=2179
    • http://ingresoindonesia.com/index.php?article=478.1&riycz=1&pdf=478
    • http://centrodepsicoterapiaintegral.com.mx/index.php?article=519.1&cpuqr=1&pdf=519
    • http://bmwt.pt/index.php?article=1452.2&qvacx=2&pdf=1452
    • http://primetimerecords.com/index.php?article=2055.1&cvsqx=1&pdf=2055
    • http://primetimerecords.com/index.php?article=1032.1&cvsqx=1&pdf=1032
    • http://primetimerecords.com/index.php?article=1485.1&cvsqx=1&pdf=1485
    • http://fresh2death.com/index.php?article=2298.1&lzrlo=1&pdf=2298
    • http://primetimerecords.com/index.php?article=302.1&cvsqx=1&pdf=302
    • http://brightworldinfotech.com/index.php?article=759.1&qfqoh=1&pdf=759
    • http://primetimerecords.com/index.php?article=1069.1&cvsqx=1&pdf=1069
    • http://www.fabulaeventos.com.br/index.php?article=2448.1&ipwdu=1&pdf=2448

Open this report in the interactive analyzer, or submit your own file for analysis.