Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5884a9716e93eb8…

MALICIOUS

PDF

11.3 KB Created: 2015-07-15 14:40:19 +04:00 Authoring application: DOMPDF
MD5: a0ba049dbedd072429645b981bf6f855 SHA-1: d8025d9e31e848279f47f59a10e8620aced34763 SHA-256: c5884a9716e93eb89ba46bdcce79414cf873702093e07e17c60b351e92b2b310
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a large number of embedded external links, characteristic of a link farm or SEO spam. The document body mentions 'binary options profits strategy', suggesting a lure to financial scams. The primary attack pattern involves directing users to external websites through these numerous links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9048

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=1185.1&wehsa=1&pdf=1185
    • http://camus-sarl.fr/index.php?article=1030.2&fnxpz=2&pdf=1030
    • http://www.lifedreams.es/index.php?article=994.1&isbrk=1&pdf=994
    • http://photo-file.ru/index.php?article=577.1&wehsa=1&pdf=577
    • http://phillipsandcoinc.com/index.php?article=1307.1&sxlyu=1&pdf=1307
    • http://photo-file.ru/index.php?article=530.1&wehsa=1&pdf=530
    • http://trans-cultures.eu/index.php?article=583.1&asedt=1&pdf=583
    • http://xserve-online.de/index.php?article=1890.1&yucuw=1&pdf=1890
    • http://pamojaexpeditions.com/index.php?article=1917.2&lqpte=2&pdf=1917
    • http://photo-file.ru/index.php?article=1775.1&wehsa=1&pdf=1775
    • http://photo-file.ru/index.php?article=755.1&wehsa=1&pdf=755
    • http://photo-file.ru/index.php?article=154.1&wehsa=1&pdf=154
    • http://primetimerecords.com/index.php?article=1902.1&cvsqx=1&pdf=1902
    • http://photo-file.ru/index.php?article=1001.1&wehsa=1&pdf=1001
    • http://www.mantrabeautybar.ca/index.php?article=607.1&rukbv=1&pdf=607
    • http://photo-file.ru/index.php?article=45.1&wehsa=1&pdf=45
    • http://geekseals.com/index.php?article=2399.1&kcbpn=1&pdf=2399

Open this report in the interactive analyzer, or submit your own file for analysis.