Malicious PDF — malware analysis report

Static analysis result for SHA-256 f63bd2e7e1745a17…

MALICIOUS

PDF

12.5 KB Created: 2015-07-16 22:08:43 +04:00 Authoring application: DOMPDF
MD5: 824d51081206a9e5777b08e174e8b042 SHA-1: 98d5d9821e563d9e047b9fda9f22479925bd4205 SHA-256: f63bd2e7e1745a17d5d4ebebefb0bbc31c276878562824fa5bc0e74088f6e2f6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a significant number of external links, characteristic of a link farm. The document body, though heavily obfuscated, contains URLs that are repeated across many entries. This suggests the primary purpose is to direct users to a network of websites, likely for SEO manipulation or to serve further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8835

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=1641.2&tpnxb=2&pdf=1641
    • http://msobo.fr/index.php?article=2166.2&dfkro=2&pdf=2166
    • http://camus-sarl.fr/index.php?article=708.3&lbido=3&pdf=708
    • http://photo-file.ru/index.php?article=1783.2&tpnxb=2&pdf=1783
    • http://www.mantrabeautybar.ca/index.php?article=1616.1&rukbv=1&pdf=1616
    • http://photo-file.ru/index.php?article=1439.2&tpnxb=2&pdf=1439
    • http://mudinside.it/index.php?article=1810.2&ozinn=2&pdf=1810
    • http://synerte.eu/index.php?article=1481.2&jaolk=2&pdf=1481
    • http://websitedesignindelhi.co.in/index.php?article=1320.1&uoohx=1&pdf=1320
    • http://photo-file.ru/index.php?article=1358.2&tpnxb=2&pdf=1358
    • http://photo-file.ru/index.php?article=858.2&tpnxb=2&pdf=858
    • http://photo-file.ru/index.php?article=1706.2&tpnxb=2&pdf=1706
    • http://howtoexcelinlife.com/index.php?article=1864.2&cnwty=2&pdf=1864
    • http://photo-file.ru/index.php?article=2334.2&tpnxb=2&pdf=2334
    • http://vioval.eu/index.php?article=2434.1&irrir=1&pdf=2434
    • http://photo-file.ru/index.php?article=2185.2&tpnxb=2&pdf=2185
    • http://marche-espoir.org/index.php?article=150.7&ilesi=7&pdf=150

Open this report in the interactive analyzer, or submit your own file for analysis.