PDF malware analysis — malicious · e16933dbd50c43cf

MALICIOUS

PDF

4.7 KB Created: 2015-06-03 18:37:19 +03:00 Authoring application: DOMPDF

MD5: 901f09db8d767c39cc221ef3e70f463c SHA-1: 10a113bf9a43659430580cfb92b4ee241a4f7887 SHA-256: e16933dbd50c43cf4bb6e7e059e16410e2296bce9d4a54834d58e813be3bf4f3

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs are structured in a way that suggests an attempt to create a link farm for SEO purposes, which is often used to distribute malicious content or redirect users to phishing sites. The document body, while truncated, also contains these URLs and discusses forex trading, a common lure. No scripts were extracted from this sample.

Heuristics 2

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gilanmetal.com/index.php?2015/deepfocus.pdf&hashd=1&aspx=924
- http://www.kbb-gesellschaft.de/index.php?2015/ergoarena.pdf&urggv=1&aspx=757
- http://www.superiorgaskets.com/index.php?2015/connected.pdf&jtwtx=1&aspx=2141
- http://www.chateauderaousset.com/index.php?2015/assets.pdf&iukpl=1&aspx=2033
- http://skloplatina.sk/index.php?2015/bloggingnews.pdf&ruryt=1&aspx=2261
- http://www.loveonlinetoday.com/index.php?2015/broadca.pdf&vrsqq=1&aspx=sitemap

Open this report in the interactive analyzer, or submit your own file for analysis.