Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3d04f264928e89f…

MALICIOUS

PDF

12.3 KB Created: 2015-07-15 05:48:18 +04:00 Authoring application: DOMPDF
MD5: d648c110b52e6657dbd9fe9202be0113 SHA-1: c30bd28c9b382940d818c6d56981f661539928cf SHA-256: a3d04f264928e89f9129d9b51e1286fbc799cc516d4ce65cdc6f33efba292f4c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier and contains a significant number of embedded URLs, forming a link farm. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' which suggests the document's purpose is to direct users to numerous external websites. While no scripts were extracted, the sheer volume and nature of the embedded URLs strongly suggest a malicious intent, likely related to SEO manipulation or distributing further malware. The document body itself is heavily obfuscated and contains some of these URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8995

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://primetimerecords.com/index.php?article=470.1&cvsqx=1&pdf=470
    • http://bluntdistribution.com/index.php?article=84.1&agzvq=1&pdf=84
    • http://asinvestmentgroup.com/index.php?article=2137.1&jckgl=1&pdf=2137
    • http://primetimerecords.com/index.php?article=1409.1&cvsqx=1&pdf=1409
    • http://www.mantrabeautybar.ca/index.php?article=18.1&rukbv=1&pdf=18
    • http://primetimerecords.com/index.php?article=2006.1&cvsqx=1&pdf=2006
    • http://brightworldinfotech.com/index.php?article=2116.1&qfqoh=1&pdf=2116
    • http://regionori.ru/index.php?article=1012.1&lcnlt=1&pdf=1012
    • http://lifesweetner.es/index.php?article=605.1&wddqo=1&pdf=605
    • http://primetimerecords.com/index.php?article=2343.1&cvsqx=1&pdf=2343
    • http://primetimerecords.com/index.php?article=432.1&cvsqx=1&pdf=432
    • http://primetimerecords.com/index.php?article=465.1&cvsqx=1&pdf=465
    • http://intelluride.co/index.php?article=1293.1&gdfls=1&pdf=1293
    • http://primetimerecords.com/index.php?article=2468.1&cvsqx=1&pdf=2468
    • http://razan.com.ua/index.php?article=231.1&vafyr=1&pdf=231
    • http://primetimerecords.com/index.php?article=1270.1&cvsqx=1&pdf=1270
    • http://modart.com.tr/index.php?article=189.1&ykgew=1&pdf=189

Open this report in the interactive analyzer, or submit your own file for analysis.