Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbe3cc07e0e189be…

MALICIOUS

PDF

12.4 KB Created: 2015-07-15 14:40:35 +04:00 Authoring application: DOMPDF
MD5: 562a1d408a680083e36e8ec0750c5d6a SHA-1: fd4b85419835bac3baa34380265891afb2dae3d0 SHA-256: cbe3cc07e0e189bedfc9d4f17b3669193824685ce0a3e3c98f1be08df281876b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified as a link farm. This suggests the primary purpose is to redirect users to external sites, potentially for SEO manipulation or to serve as a distribution point for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8835

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=2155.1&wehsa=1&pdf=2155
    • http://razan.com.ua/index.php?article=823.1&vafyr=1&pdf=823
    • http://amicosmeceutici.it/index.php?article=2306.1&replv=1&pdf=2306
    • http://photo-file.ru/index.php?article=2257.1&wehsa=1&pdf=2257
    • http://ve-klubber.dk/index.php?article=438.1&jzwgf=1&pdf=438
    • http://photo-file.ru/index.php?article=2086.1&wehsa=1&pdf=2086
    • http://www.mantrabeautybar.ca/index.php?article=1075.1&rukbv=1&pdf=1075
    • http://healthcare2-concepts.com/index.php?article=1496.1&syyyl=1&pdf=1496
    • http://ehsaasmhs.org/index.php?article=1565.1&qcugi=1&pdf=1565
    • http://photo-file.ru/index.php?article=775.1&wehsa=1&pdf=775
    • http://photo-file.ru/index.php?article=1564.1&wehsa=1&pdf=1564
    • http://photo-file.ru/index.php?article=1765.1&wehsa=1&pdf=1765
    • http://alears.lv/index.php?article=340.2&cqwcy=2&pdf=340
    • http://photo-file.ru/index.php?article=583.1&wehsa=1&pdf=583
    • http://msobo.fr/index.php?article=1070.2&dfkro=2&pdf=1070
    • http://photo-file.ru/index.php?article=1088.1&wehsa=1&pdf=1088
    • http://www.pieuvre-electrique-toulousaine.fr/index.php?article=2069.1&otafi=1&pdf=2069

Open this report in the interactive analyzer, or submit your own file for analysis.