Malicious PDF — malware analysis report

Static analysis result for SHA-256 034c4015fe416f00…

MALICIOUS

PDF

31.5 KB Created: 2019-05-24 00:42:23 +03:00 Authoring application: Adobe InDesign CC (Macintosh) (via Adobe PDF Library 10.0.1)
MD5: 0fe0ba80659fdccca214b64796d8f494 SHA-1: 0ba357334de46406e5839321d8329b0f14489731 SHA-256: 034c4015fe416f0050ebee4c824b7926dc1f17714ca4f53fbc571edca69b671b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of embedded links to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a website hosting numerous PDF documents, potentially for SEO spam or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8447

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/human-nature-novella-of-the-lupi-a-novella-of-the.pdf
    • http://www.gorillawalker.com/skeet-and-how-to-shoot-it.pdf
    • http://www.gorillawalker.com/acupuncture-for-cervical-spondylosis-simplified-an-illustrated-guide.pdf
    • http://www.gorillawalker.com/painting-the-maya-universe-royal-ceramics-of-the-classic-period.pdf
    • http://www.gorillawalker.com/mammoth-book-of-formula-one.pdf
    • http://www.gorillawalker.com/tiny-essentials-of-writing-for-fundraising.pdf
    • http://www.gorillawalker.com/diet-therapy-for-complications-of-diabetes-the-4th-edition-chinese.pdf
    • http://www.gorillawalker.com/athlete-vs-mathlete-double-dribble-kindle-edition.pdf
    • http://www.gorillawalker.com/el-nombre-de-la-rosa.pdf
    • http://www.gorillawalker.com/elements-of-nature-2015-wall-calendar.pdf
    • http://www.gorillawalker.com/naughty-4-urban-renaissance.pdf
    • http://www.gorillawalker.com/avancemos-cuaderno-practica-por-niveles-student-level-3-spanish-edition.pdf
    • http://www.gorillawalker.com/god-s-covenant-with-you-for-deliverance-and-freedom-come.pdf
    • http://www.gorillawalker.com/the-courtship-of-miles-standish-instructor-literature-series-no-13.pdf
    • http://www.gorillawalker.com/marionettes-german-and-english-edition.pdf
    • http://www.gorillawalker.com/ikwa-of-the-mound-builder-indians.pdf
    • http://www.gorillawalker.com/the-ocean-almanac.pdf
    • http://www.gorillawalker.com/cirque-du-soleil-easy-piano.pdf
    • http://www.gorillawalker.com/a-history-of-american-movies-a-film-by-film-look.pdf
    • http://www.gorillawalker.com/violence-and-abuse-reasons-and-remedies.pdf
    • http://www.gorillawalker.com/modernist-aesthetics-in-taiwanese-poetry-since-the-1950s-sinica-leidensia.pdf
    • http://www.gorillawalker.com/java-how-to-program-late-objects-version-addison-wesley-s.pdf
    • http://www.gorillawalker.com/the-form-of-the-book-essays-on-the-morality-of.pdf
    • http://www.gorillawalker.com/jealousy-how-to-deal-with-it-for-men.pdf
    • http://www.gorillawalker.com/classic-songs-of-the-80s-piano-vocal-chords.pdf
    • http://www.gorillawalker.com/integrated-arithmetic-and-basic-algebra-4th-edition.pdf
    • http://www.gorillawalker.com/lockwood-co-book-three-the-hollow-boy.pdf
    • http://www.gorillawalker.com/college-financial-aid-arco-college-scholarships-financial-aid.pdf
    • http://www.gorillawalker.com/the-servant-s-hand-english-fiction-from-below.pdf
    • http://www.gorillawalker.com/multiwavelength-optical-lans.pdf
    • http://www.gorillawalker.com/international-investment-law-a-handbook.pdf
    • http://www.gorillawalker.com/keep-me-safe-slow-burn-series-book-1.pdf
    • http://www.gorillawalker.com/bowel-nosodes-in-homeopathic-practice.pdf
    • http://www.gorillawalker.com/how-to-do-everything-ipad.pdf
    • http://www.gorillawalker.com/the-undeserving-poor-from-the-war-on-poverty-to-the.pdf
    • http://www.gorillawalker.com/making-sense-of-chindia-reflections-on-china-and-india.pdf
    • http://www.gorillawalker.com/a-normal-pakistani.pdf
    • http://www.gorillawalker.com/the-wisdom-of-your-cells-how-your-beliefs-control-your.pdf
    • http://www.gorillawalker.com/french-slanguage.pdf
    • http://www.gorillawalker.com/reflexology-learn-how-to-use-reflexology-with-easy-techniques-and.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.