Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc2b1da07ac26f01…

MALICIOUS

PDF

11.7 KB Created: 2015-07-15 16:26:52 +04:00 Authoring application: DOMPDF
MD5: 7e714e8c338134e110f3344052c87f7c SHA-1: 67a8bcbfa927fd10b15e581b7eb7a040009be3cc SHA-256: fc2b1da07ac26f017c74337011e943a64c0d877cefe7573d5525ebbe30344ef6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1059.001 Command and Scripting Interpreter:PowerShell

The PDF file was flagged by a machine learning classifier and contains a large number of embedded URLs, indicating a link farm. The primary heuristic identified a 'PDF_SEO_LINK_FARM' which suggests the document's purpose is to direct users to numerous external websites. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8959

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chavagnes.com/index.php?article=1976.2&urwbo=2&pdf=1976
    • http://les-zephyrs.com/index.php?article=2495.2&ylevy=2&pdf=2495
    • http://information32.org/index.php?article=979.1&ugibr=1&pdf=979
    • http://chavagnes.com/index.php?article=1542.2&urwbo=2&pdf=1542
    • http://primetimerecords.com/index.php?article=310.1&cvsqx=1&pdf=310
    • http://chavagnes.com/index.php?article=962.2&urwbo=2&pdf=962
    • http://trans-cultures.eu/index.php?article=1083.1&asedt=1&pdf=1083
    • http://razan.com.ua/index.php?article=644.1&vafyr=1&pdf=644
    • http://konserborsasi.com/index.php?article=1777.1&ntrdf=1&pdf=1777
    • http://chavagnes.com/index.php?article=175.2&urwbo=2&pdf=175
    • http://chavagnes.com/index.php?article=1517.2&urwbo=2&pdf=1517
    • http://chavagnes.com/index.php?article=623.2&urwbo=2&pdf=623
    • http://alears.lv/index.php?article=291.2&cqwcy=2&pdf=291
    • http://chavagnes.com/index.php?article=1914.2&urwbo=2&pdf=1914
    • http://www.mantrabeautybar.ca/index.php?article=339.1&rukbv=1&pdf=339
    • http://chavagnes.com/index.php?article=941.2&urwbo=2&pdf=941
    • http://dfnotebooks.com.br/index.php?article=374.1&gatis=1&pdf=374

Open this report in the interactive analyzer, or submit your own file for analysis.