Malicious PDF — malware analysis report

Static analysis result for SHA-256 e194e9a01e47b0f1…

MALICIOUS

PDF

11.5 KB Created: 2015-07-15 14:41:45 +04:00 Authoring application: DOMPDF
MD5: 4617aa2eb56758b486c6c281e259ee71 SHA-1: f9a9a516dffd59711d5daf22ff42285c61010d5f SHA-256: e194e9a01e47b0f1a6075a39d1862be00df7a612e3382d19f9484036d5e39a38
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though heavily obfuscated, also contains these URLs, suggesting the primary purpose is to direct users to these external sites. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious classification. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=1047.1&wehsa=1&pdf=1047
    • http://whereabouts.eu/index.php?article=2394.2&ahydd=2&pdf=2394
    • http://marjangecevic.com/index.php?article=1500.1&vgslo=1&pdf=1500
    • http://photo-file.ru/index.php?article=584.1&wehsa=1&pdf=584
    • http://techaccesscorp.com/index.php?article=2341.2&dupth=2&pdf=2341
    • http://photo-file.ru/index.php?article=2165.1&wehsa=1&pdf=2165
    • http://castres-ski-passion.fr/index.php?article=2441.2&rpbeh=2&pdf=2441
    • http://epremier.ro/index.php?article=1292.1&ivdfx=1&pdf=1292
    • http://logimarket.com.tr/index.php?article=1857.1&ewcgf=1&pdf=1857
    • http://photo-file.ru/index.php?article=1432.1&wehsa=1&pdf=1432
    • http://photo-file.ru/index.php?article=2191.1&wehsa=1&pdf=2191
    • http://photo-file.ru/index.php?article=1839.1&wehsa=1&pdf=1839
    • http://www.ivanandpamela.com/index.php?article=1751.1&tekgj=1&pdf=1751
    • http://photo-file.ru/index.php?article=311.1&wehsa=1&pdf=311
    • http://rollermarathondijon.fr/index.php?article=1123.2&rbpva=2&pdf=1123
    • http://photo-file.ru/index.php?article=1707.1&wehsa=1&pdf=1707
    • http://www.mantrabeautybar.ca/index.php?article=1856.1&rukbv=1&pdf=1856

Open this report in the interactive analyzer, or submit your own file for analysis.