Malicious PDF — malware analysis report

Static analysis result for SHA-256 c753a314151d42b3…

MALICIOUS

PDF

11.9 KB Created: 2015-07-15 14:37:51 +04:00 Authoring application: DOMPDF First seen: 2015-08-19
MD5: e7eb42303c831653f3a66f881761c829 SHA-1: a7a7098694db4f8be9e7af05c326e05b00277293 SHA-256: c753a314151d42b30baf61ce891169b60e17328814af5cca4af39a00a669ef6a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. It contains numerous embedded URLs, including one pointing to 'photo-file.ru', suggesting a phishing or credential harvesting attempt. No scripts were extracted, but the presence of multiple external links indicates a likely attempt to redirect the user to a compromised or malicious website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=2181.1&wehsa=1&pdf=2181 In PDF document text
    • http://www.mantrabeautybar.ca/index.php?article=32.1&rukbv=1&pdf=32In PDF document text
    • http://rollermarathondijon.fr/index.php?article=2477.2&rbpva=2&pdf=2477In PDF document text
    • http://photo-file.ru/index.php?article=980.1&wehsa=1&pdf=980In PDF document text
    • http://munchkinmoments.com.my/index.php?article=158.1&itqlp=1&pdf=158In PDF document text
    • http://photo-file.ru/index.php?article=1958.1&wehsa=1&pdf=1958In PDF document text
    • http://amicosmeceutici.it/index.php?article=762.1&replv=1&pdf=762In PDF document text
    • http://marcogulf.com/index.php?article=2094.1&puzto=1&pdf=2094In PDF document text
    • http://michele-jimenez.com/index.php?article=1662.1&dwpcn=1&pdf=1662In PDF document text
    • http://photo-file.ru/index.php?article=2422.1&wehsa=1&pdf=2422In PDF document text
    • http://photo-file.ru/index.php?article=1325.1&wehsa=1&pdf=1325In PDF document text
    • http://photo-file.ru/index.php?article=308.1&wehsa=1&pdf=308In PDF document text
    • http://riddlet.com/index.php?article=1650.2&bxiuo=2&pdf=1650In PDF document text
    • http://photo-file.ru/index.php?article=2338.1&wehsa=1&pdf=2338In PDF document text
    • http://healthcare2-concepts.com/index.php?article=305.1&syyyl=1&pdf=305In PDF document text
    • http://photo-file.ru/index.php?article=946.1&wehsa=1&pdf=946In PDF document text
    • http://www.wallart.com.es/index.php?article=176.1&dxunj=1&pdf=176In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off000002f8.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2F8 13612 bytes
SHA-256: 3a588716926c39ebddfc50a6ea4f0b59aa99fb4cc47fa49b04320e25f35dabc8

Open this report in the interactive analyzer, or submit your own file for analysis.