Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3ea524bbd7bdb99…

MALICIOUS

PDF

7.5 KB Created: 2015-06-04 18:32:13 +04:00 Authoring application: DOMPDF First seen: 2015-06-09
MD5: 8a136371fc28e92d8bfa03779e58d81c SHA-1: 68f30938437c5bb803339e1d65083cf1a0653ce3 SHA-256: e3ea524bbd7bdb998b1394e8a61a0256a164d1d1185771414daa9bfe1911d45e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains multiple embedded URLs that are all related to binary options trading. The ML classifier also flagged this PDF as malicious. The document body text, though partially corrupted, also contains references to trading and options. The primary attack pattern appears to be directing users to potentially malicious websites disguised as trading information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6810

Heuristics 2

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.vanwillegenconsult.nl/index.php?wiki/04/06/2015/themefuse/binary+options+easy.pdf&oxhqf=1&news=2867 In PDF document text
    • http://destilleria.com/index.php?wiki/04/06/2015/productfolio/binary+options+newsletter.pdf&fhrqa=1&news=1871In PDF document text
    • http://www.yuzbasiogluproje.com.tr/index.php?wiki/04/06/2015/juventus/binary+options+xls.pdf&kqwap=1&news=263In PDF document text
    • http://www.vaughantelecom.ca/index.php?wiki/04/06/2015/designmodo/binary+option+cheats.pdf&zeles=1&news=129In PDF document text
    • http://orunmarine.com/index.php?wiki/04/06/2015/mundoindica/$10+binary+options.pdf&wxnjt=1&news=93In PDF document text
    • http://www.plzenska-knihvazba.cz/index.php?wiki/04/06/2015/newsley/binary+option+handel.pdf&oljvs=2&news=2722In PDF document text
    • http://www.supermaraton.eu/index.php?wiki/04/06/2015/housepop/binaryoptionstradingguide.com.pdf&owutp=1&news=sitemapIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.