Malicious PDF — malware analysis report

Static analysis result for SHA-256 006c7c791d0de22c…

MALICIOUS

PDF

42.5 KB Created: 2018-11-15 18:32:24 +03:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.17)
MD5: 838e0d257f94ce11b7ce57cb45a15ed9 SHA-1: 5eb07f3bcd46f37487a8eed1548b2817b866d483 SHA-256: 006c7c791d0de22c67ad0e5437f03009f46fb98f762f33b45232d2f2250e82e8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily obfuscated, the primary function appears to be directing users to a wide array of external PDF resources, potentially for SEO abuse or to host malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/applying-critical-social-theories-to-family-therapy-practice-afta-springerbriefs.pdf
    • http://www.gorillawalker.com/i-invited-a-dragon-to-dinner-and-other-poems-to.pdf
    • http://www.gorillawalker.com/how-the-internet-works-8th-edition.pdf
    • http://www.gorillawalker.com/hating-whitey-and-other-progressive-causes.pdf
    • http://www.gorillawalker.com/alzheimer-discourse-some-sociolinguistic-dimensions-routledge-communication-series.pdf
    • http://www.gorillawalker.com/dalai-lama-my-son-a-mother-s-story.pdf
    • http://www.gorillawalker.com/indian-antiquities-or-dissertations-relative-to-the-ancient-volume-7.pdf
    • http://www.gorillawalker.com/marrakech-and-environs-and-essaouira-kane-60.pdf
    • http://www.gorillawalker.com/offsides.pdf
    • http://www.gorillawalker.com/camp-waterfront-management.pdf
    • http://www.gorillawalker.com/the-many-facets-of-graph-theory-proceedings-of-the-conference.pdf
    • http://www.gorillawalker.com/catamount.pdf
    • http://www.gorillawalker.com/keep-your-wives-away-from-them-orthodox-women-unorthodox-desires.pdf
    • http://www.gorillawalker.com/the-beijing-olympiad-the-political-economy-of-a-sporting-mega.pdf
    • http://www.gorillawalker.com/speaking-rights-to-power-constructing-political-will.pdf
    • http://www.gorillawalker.com/our-island-story.pdf
    • http://www.gorillawalker.com/rats-fun-care-books.pdf
    • http://www.gorillawalker.com/notes-on-soyinka-s-lion-and-the-jewel-york-notes.pdf
    • http://www.gorillawalker.com/tidings-from-the-abyss-70-disturbing-micro-dramas.pdf
    • http://www.gorillawalker.com/the-prevention-and-intervention-of-genocide-an-annotated-bibliography.pdf
    • http://www.gorillawalker.com/how-to-get-dressed-survival-skills-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/commercial-refrigeration-for-air-conditioning-technicians.pdf
    • http://www.gorillawalker.com/cheri-s-taboo-collection-11.pdf
    • http://www.gorillawalker.com/evinrude-johnson-85-300-hp-two-stroke-1995-2002-clymer.pdf
    • http://www.gorillawalker.com/philippines-and-manila-nelles-map-english-french-and-german-edition.pdf
    • http://www.gorillawalker.com/game-set-match.pdf
    • http://www.gorillawalker.com/women-in-narcotics-anonymous-overcoming-stigma-and-shame-palgrave-pivot.pdf
    • http://www.gorillawalker.com/estado-neoliberalismo-y-politica-agraria-en-chile-1973-1981-latin.pdf
    • http://www.gorillawalker.com/berlin-in-the-cold-war-1948-1990-documents-on-british.pdf
    • http://www.gorillawalker.com/billy-goat-gruff-a-short-play-for-kids-kindle-edition.pdf
    • http://www.gorillawalker.com/promise-of-joy-the-presidency-of-orrin-knox-advise-and.pdf
    • http://www.gorillawalker.com/goldilocks-and-the-three-weres-alpha-werebear-paranormal-erotic-romance.pdf
    • http://www.gorillawalker.com/summer-reading-renaissance-an-interactive-exhibits-approach.pdf
    • http://www.gorillawalker.com/the-photo-book-of-turkey-images-of-turkish-architecture-culture.pdf
    • http://www.gorillawalker.com/the-fire-in-my-soul-a-memoir.pdf
    • http://www.gorillawalker.com/science-a-discovery-in-comics.pdf
    • http://www.gorillawalker.com/the-only-hope-of-the-world-george-bernard-shaw-and.pdf
    • http://www.gorillawalker.com/give-me-your-tomorrow.pdf
    • http://www.gorillawalker.com/css-the-missing-manual-missing-manuals.pdf
    • http://www.gorillawalker.com/introduction-to-wordstar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.