PDF malware analysis — malicious · e78b5601b624b4ce

MALICIOUS

PDF

5.1 KB Created: 2015-06-03 16:38:11 +03:00 Authoring application: DOMPDF

MD5: 8686220e542209011266b8e8e0663e2e SHA-1: 266aa52a7c5703e0cc287111f008029d6cbdaf41 SHA-256: e78b5601b624b4ce1f31f7c7ee4483cd2a64b44975420e303c72b2066906add6

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The document body, while containing text related to forex trading, also repeats these URLs, reinforcing the link-farming behavior. No scripts were extracted, and the primary malicious behavior observed is the extensive use of external links.

Heuristics 2

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.academiafutebolangola.com/index.php?2015/hmdeepfocus.pdf&audtr=1&aspx=2057
- http://www.prequine.com/index.php?2015/torcida.pdf&fcldj=1&aspx=356
- http://www.prequine.com/index.php?2015/torcida.pdf&fcldj=1&aspx=2443
- http://www.kbb-gesellschaft.de/index.php?2015/ergoarena.pdf&urggv=1&aspx=2339
- http://www.academiafutebolangola.com/index.php?2015/hmdeepfocus.pdf&audtr=1&aspx=1655
- http://dyrlaegecentret.dk/index.php?2015/typestitch.pdf&hjhle=1&aspx=sitemap

Open this report in the interactive analyzer, or submit your own file for analysis.