Malicious PDF — malware analysis report

Static analysis result for SHA-256 fcba8b3a31ade8d4…

MALICIOUS

PDF

10.8 KB Created: 2015-07-15 14:39:01 +04:00 Authoring application: DOMPDF
MD5: 885d972864719f34c3ea1ae1cd0fbcb1 SHA-1: 7b6aa2a749daf7a93af8ee4b4f4647076f7dd5ee SHA-256: fcba8b3a31ade8d404da8042da30157fb73ca4bb4d3aa546b8797632127dd027
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. The document body mentions 'Binary option review scam queen', suggesting a lure to financial scams. The ML classifier also flagged the PDF as malicious. The primary attack pattern involves directing users to a multitude of external websites, likely for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9059

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://photo-file.ru/index.php?article=431.1&wehsa=1&pdf=431
    • http://castres-ski-passion.fr/index.php?article=1936.2&rpbeh=2&pdf=1936
    • http://ehsaasmhs.org/index.php?article=402.1&qcugi=1&pdf=402
    • http://photo-file.ru/index.php?article=982.1&wehsa=1&pdf=982
    • http://www.kingdomfaithchurch.org/index.php?article=1416.1&fksac=1&pdf=1416
    • http://photo-file.ru/index.php?article=1800.1&wehsa=1&pdf=1800
    • http://www.mantrabeautybar.ca/index.php?article=1989.1&rukbv=1&pdf=1989
    • http://immofina-solutions.com/index.php?article=2087.1&gzogv=1&pdf=2087
    • http://fabrykablysku.com/index.php?article=1385.1&otolk=1&pdf=1385
    • http://photo-file.ru/index.php?article=1423.1&wehsa=1&pdf=1423
    • http://photo-file.ru/index.php?article=64.1&wehsa=1&pdf=64
    • http://photo-file.ru/index.php?article=1175.1&wehsa=1&pdf=1175
    • http://propertarian.net/index.php?article=432.1&jdxyr=1&pdf=432
    • http://photo-file.ru/index.php?article=1603.1&wehsa=1&pdf=1603
    • http://lifesweetner.es/index.php?article=2433.1&wddqo=1&pdf=2433
    • http://photo-file.ru/index.php?article=603.1&wehsa=1&pdf=603
    • http://power-team.cz/index.php?article=1816.3&uwbuc=3&pdf=1816

Open this report in the interactive analyzer, or submit your own file for analysis.