PDF malware analysis — malicious · a83a918fdc3f162f

MALICIOUS

PDF

4.7 KB Created: 2015-06-03 16:37:49 +03:00 Authoring application: DOMPDF

MD5: 00e3655514c7aa223c3108b2c84ed465 SHA-1: 4327606e1d3a44e784fe7aab5e911927cbb0307a SHA-256: a83a918fdc3f162fc57f98e323accb2b4d09e8ab307e779488132e39e8deb94b

60 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO link farming or to redirect users to malicious sites. The document body also contains numerous links and text related to forex trading, suggesting a lure to attract users interested in financial schemes. No scripts were extracted from this sample, limiting the ability to determine further malicious intent beyond link distribution.

Machine Learning

Nyx PDF Classifier clean score 0.1457

Heuristics 2

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.academiafutebolangola.com/index.php?2015/hmdeepfocus.pdf&audtr=1&aspx=1138
- http://phcccolorado.org/index.php?2015/arabtera.pdf&effpp=1&aspx=810
- http://phcccolorado.org/index.php?2015/arabtera.pdf&effpp=1&aspx=1742
- http://www.prequine.com/index.php?2015/torcida.pdf&fcldj=1&aspx=566
- http://phcccolorado.org/index.php?2015/arabtera.pdf&effpp=1&aspx=316
- http://dyrlaegecentret.dk/index.php?2015/typestitch.pdf&hjhle=1&aspx=sitemap

Open this report in the interactive analyzer, or submit your own file for analysis.