Malicious PDF — malware analysis report

Static analysis result for SHA-256 b54135e78c5a90c2…

MALICIOUS

PDF

11.1 KB Created: 2015-07-15 14:38:44 +04:00 Authoring application: DOMPDF
MD5: 7da3a11a59331066b96aa88a975efa2d SHA-1: 2004a592467a78244d2ace93b159fb884f593059 SHA-256: b54135e78c5a90c2c7e91a7c77bfc422ffd72b4e1423d47fbad4575fa96eb61b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded URLs, forming a link farm. The primary heuristic identified this as a 'PDF_SEO_LINK_FARM' attack pattern, indicating the document's purpose is to direct users to numerous external websites, likely for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9048

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=549.1&wehsa=1&pdf=549
    • http://krummenacher-haustechnik.ch/index.php?article=2249.1&ptfan=1&pdf=2249
    • http://www.mantrabeautybar.ca/index.php?article=603.1&rukbv=1&pdf=603
    • http://photo-file.ru/index.php?article=1291.1&wehsa=1&pdf=1291
    • http://domedesigner.com/index.php?article=1868.1&urgni=1&pdf=1868
    • http://photo-file.ru/index.php?article=1299.1&wehsa=1&pdf=1299
    • http://gchrismanelectric.com/index.php?article=2238.1&txuhv=1&pdf=2238
    • http://www.pieuvre-electrique-toulousaine.fr/index.php?article=474.1&otafi=1&pdf=474
    • http://mudinside.it/index.php?article=1936.2&ozinn=2&pdf=1936
    • http://photo-file.ru/index.php?article=1477.1&wehsa=1&pdf=1477
    • http://photo-file.ru/index.php?article=2169.1&wehsa=1&pdf=2169
    • http://photo-file.ru/index.php?article=2027.1&wehsa=1&pdf=2027
    • http://harmenhomes.ca/index.php?article=2230.1&wcdhp=1&pdf=2230
    • http://photo-file.ru/index.php?article=2019.1&wehsa=1&pdf=2019
    • http://www.fabulaeventos.com.br/index.php?article=760.1&ipwdu=1&pdf=760
    • http://photo-file.ru/index.php?article=1873.1&wehsa=1&pdf=1873
    • http://urbanindoorgs.com/index.php?article=2233.1&lkbfl=1&pdf=2233

Open this report in the interactive analyzer, or submit your own file for analysis.