Malicious PDF — malware analysis report

Static analysis result for SHA-256 f508a34aee5f37b8…

MALICIOUS

PDF

11.8 KB Created: 2015-07-15 16:22:56 +04:00 Authoring application: DOMPDF
MD5: 31577ba8566e4614341f4f249556927e SHA-1: 742c024580760a0b301c6a8482e557146ec9510c SHA-256: f508a34aee5f37b8e6f579c7980d1f588582014cc5f031dfa303f05ad0f7bd1a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The document body, though truncated, mentions 'binary option system' and 'trading', suggesting a lure for financial scams. The primary attack pattern involves directing users to a multitude of external websites through these links, likely for phishing or fraudulent schemes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chavagnes.com/index.php?article=769.2&urwbo=2&pdf=769
    • http://kontraportal.com/index.php?article=751.1&szjdf=1&pdf=751
    • http://alears.lv/index.php?article=954.2&cqwcy=2&pdf=954
    • http://chavagnes.com/index.php?article=808.2&urwbo=2&pdf=808
    • http://edezigntesting.com/index.php?article=2055.1&vwddn=1&pdf=2055
    • http://chavagnes.com/index.php?article=493.2&urwbo=2&pdf=493
    • http://pleasereadbible.com/index.php?article=343.1&ofdkh=1&pdf=343
    • http://upkartfashion.com/index.php?article=1815.1&gggrk=1&pdf=1815
    • http://riddlet.com/index.php?article=1587.2&bxiuo=2&pdf=1587
    • http://chavagnes.com/index.php?article=2362.2&urwbo=2&pdf=2362
    • http://chavagnes.com/index.php?article=2024.2&urwbo=2&pdf=2024
    • http://chavagnes.com/index.php?article=1621.2&urwbo=2&pdf=1621
    • http://heathervincentlandscapes.com.au/index.php?article=1650.1&bsylx=1&pdf=1650
    • http://chavagnes.com/index.php?article=270.2&urwbo=2&pdf=270
    • http://aksoynet.nl/index.php?article=2384.2&cwiie=2&pdf=2384
    • http://chavagnes.com/index.php?article=1355.2&urwbo=2&pdf=1355
    • http://www.mantrabeautybar.ca/index.php?article=1491.1&rukbv=1&pdf=1491

Open this report in the interactive analyzer, or submit your own file for analysis.