Malicious PDF — malware analysis report

Static analysis result for SHA-256 f83b03c37164114e…

MALICIOUS

PDF

12.8 KB Created: 2015-07-15 14:37:01 +04:00 Authoring application: DOMPDF
MD5: e59fef5b3b88e422e6d554ad5ad3b3b7 SHA-1: ba47ae3c35978a1317738d2f8cd6878149e0d6ea SHA-256: f83b03c37164114e86ad4f3f965313282ca38639cf166f37e2f313836d4390f0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier and contains a large number of external links, characteristic of a link farm or SEO spam. The document body mentions 'binary option trading' and 'equity options trading', suggesting a lure to financial scam sites. The embedded URLs are likely used to direct users to these sites or potentially to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8742

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=326.1&wehsa=1&pdf=326
    • http://archerwealth.com.au/index.php?article=1174.1&ldzws=1&pdf=1174
    • http://cocoonin.fr/index.php?article=628.1&ybtii=1&pdf=628
    • http://photo-file.ru/index.php?article=727.1&wehsa=1&pdf=727
    • http://marjangecevic.com/index.php?article=818.1&vgslo=1&pdf=818
    • http://photo-file.ru/index.php?article=2324.1&wehsa=1&pdf=2324
    • http://www.mantrabeautybar.ca/index.php?article=1656.1&rukbv=1&pdf=1656
    • http://razan.com.ua/index.php?article=355.1&vafyr=1&pdf=355
    • http://www.motz73.fr/index.php?article=538.1&vrqcc=1&pdf=538
    • http://photo-file.ru/index.php?article=629.1&wehsa=1&pdf=629
    • http://photo-file.ru/index.php?article=2423.1&wehsa=1&pdf=2423
    • http://photo-file.ru/index.php?article=336.1&wehsa=1&pdf=336
    • http://ve-klubben.dk/index.php?article=2419.1&zcpvv=1&pdf=2419
    • http://photo-file.ru/index.php?article=67.1&wehsa=1&pdf=67
    • http://information32.org/index.php?article=1031.1&ugibr=1&pdf=1031
    • http://photo-file.ru/index.php?article=56.1&wehsa=1&pdf=56
    • http://www.dikiliermanoto.com/index.php?article=1445.1&snsfa=1&pdf=1445

Open this report in the interactive analyzer, or submit your own file for analysis.