Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6f02d35d0e2218f…

MALICIOUS

PDF

12.1 KB Created: 2015-07-15 14:39:53 +04:00 Authoring application: DOMPDF
MD5: b8d3576a91f64414f7a6eda7012d345c SHA-1: 06c2c927d17fb0df68e709f4e081249a0a7d2c12 SHA-256: a6f02d35d0e2218fdc1689b008eeede844195427ba9daeee63b3412005f26e8c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a link farm or SEO poisoning attack. The ML classifier also flagged the document as malicious. The primary goal appears to be directing users to a multitude of external websites, likely for malicious redirection or to inflate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8843

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=1983.1&wehsa=1&pdf=1983
    • http://www.mantrabeautybar.ca/index.php?article=510.1&rukbv=1&pdf=510
    • http://rollermarathondijon.fr/index.php?article=1457.2&rbpva=2&pdf=1457
    • http://photo-file.ru/index.php?article=120.1&wehsa=1&pdf=120
    • http://fotosalon-zoom.ru/index.php?article=1061.4&sufyu=4&pdf=1061
    • http://photo-file.ru/index.php?article=1102.1&wehsa=1&pdf=1102
    • http://camus-sarl.fr/index.php?article=1206.2&fnxpz=2&pdf=1206
    • http://marcogulf.com/index.php?article=834.1&puzto=1&pdf=834
    • http://tngszkolenia.com/index.php?article=1757.2&kiojv=2&pdf=1757
    • http://photo-file.ru/index.php?article=2241.1&wehsa=1&pdf=2241
    • http://photo-file.ru/index.php?article=706.1&wehsa=1&pdf=706
    • http://photo-file.ru/index.php?article=583.1&wehsa=1&pdf=583
    • http://madejalook.com/index.php?article=859.1&ynlkg=1&pdf=859
    • http://photo-file.ru/index.php?article=1002.1&wehsa=1&pdf=1002
    • http://konserborsasi.com/index.php?article=1649.1&ntrdf=1&pdf=1649
    • http://photo-file.ru/index.php?article=209.1&wehsa=1&pdf=209
    • http://www.fabulaeventos.com.br/index.php?article=626.1&ipwdu=1&pdf=626

Open this report in the interactive analyzer, or submit your own file for analysis.