Malicious PDF — malware analysis report

Static analysis result for SHA-256 efea85be7dc2e05a…

MALICIOUS

PDF

11.9 KB Created: 2015-07-15 14:38:07 +04:00 Authoring application: DOMPDF
MD5: 00d8bd019cf656138b8c63fdda6149c1 SHA-1: 8fea006b020b81bf9327b950064237c93f9d6583 SHA-256: efea85be7dc2e05a9d78d63d0d4d79f9d3128c0987ca9e3a3901377a54ffcbe9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a large number of embedded external links, indicative of a link farm or SEO manipulation tactic. The document body mentions 'binary option company' and 'option trading', suggesting a lure to financial scam websites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=1512.1&wehsa=1&pdf=1512
    • http://top-rice-cooker.com/index.php?article=353.1&ratfe=1&pdf=353
    • http://www.mantrabeautybar.ca/index.php?article=660.1&rukbv=1&pdf=660
    • http://photo-file.ru/index.php?article=186.1&wehsa=1&pdf=186
    • http://michele-jimenez.com/index.php?article=2137.1&dwpcn=1&pdf=2137
    • http://photo-file.ru/index.php?article=1293.1&wehsa=1&pdf=1293
    • http://kameraturva.net/index.php?article=230.4&ghbga=4&pdf=230
    • http://www.myrlimo.com/index.php?article=551.1&sqfkb=1&pdf=551
    • http://motorsportroden.nl/index.php?article=1986.2&onaih=2&pdf=1986
    • http://photo-file.ru/index.php?article=975.1&wehsa=1&pdf=975
    • http://photo-file.ru/index.php?article=610.1&wehsa=1&pdf=610
    • http://photo-file.ru/index.php?article=997.1&wehsa=1&pdf=997
    • http://xserve-online.de/index.php?article=345.1&yucuw=1&pdf=345
    • http://photo-file.ru/index.php?article=1333.1&wehsa=1&pdf=1333
    • http://casarosso.com.tr/index.php?article=143.1&gdggi=1&pdf=143
    • http://photo-file.ru/index.php?article=1372.1&wehsa=1&pdf=1372
    • http://cierzodemontana.com/index.php?article=264.7&vfjgt=7&pdf=264

Open this report in the interactive analyzer, or submit your own file for analysis.