Malicious PDF — malware analysis report

Static analysis result for SHA-256 04baadca5e8faf64…

MALICIOUS

PDF

43.0 KB Created: 2018-11-23 21:01:42 +03:00 Authoring application: Acrobat PDFMaker 7.0 для Word (via Acrobat Distiller 7.0.5 (Windows))
MD5: cc6fefe0f2e80ba2afe7a073b7e483fc SHA-1: 961f235eb1df0a268048479ff2c29a174fecba54 SHA-256: 04baadca5e8faf6493de125ed97d8a083d5e213f6356656475973b0b6267f170
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a large collection of linked documents, potentially for SEO spam or to distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/qualit-tsmanagement-im-bauwesen-vdi-buch-german-edition.pdf
    • http://www.gorillawalker.com/by-collins-uk-2015-collins-scotland-road-map-fol-map.pdf
    • http://www.gorillawalker.com/jolly-roger-chinese-characters.pdf
    • http://www.gorillawalker.com/henry-the-helpful-elephant-squeaky-clean.pdf
    • http://www.gorillawalker.com/dictador-del-futuro-el-spanish-edition.pdf
    • http://www.gorillawalker.com/something-else-wicked-felig-chronicles-book-2.pdf
    • http://www.gorillawalker.com/the-parables-of-jesus-participant-s-guide-six-in-depth.pdf
    • http://www.gorillawalker.com/it-s-not-the-size-of-the-data-it-s.pdf
    • http://www.gorillawalker.com/ingles-para-conversacion-texto-completo-english-for-conversation-unabridged-audible.pdf
    • http://www.gorillawalker.com/notes-on-nursing-what-it-is-and-what-it-is.pdf
    • http://www.gorillawalker.com/olympia-bfi-film-classics.pdf
    • http://www.gorillawalker.com/to-amend-title-xix-of-the-social-security-act-to.pdf
    • http://www.gorillawalker.com/schumann-symphonic-etudes-op-13-etudes-en-forme-de-variations.pdf
    • http://www.gorillawalker.com/the-rising-author-s-preferred-edition.pdf
    • http://www.gorillawalker.com/who-is-the-beast.pdf
    • http://www.gorillawalker.com/new-mystudentsuccesslabplus-with-pearson-etext-standalone-access-card-for-the.pdf
    • http://www.gorillawalker.com/wilderness-survival-skills-sierra-club-knowledge-cards-deck.pdf
    • http://www.gorillawalker.com/why-go-to-confession-a-scriptographic-booklet.pdf
    • http://www.gorillawalker.com/jane-asher-s-book-of-cake-decorating-ideas.pdf
    • http://www.gorillawalker.com/silver-bullet-volume-4-montana-s-man-kevin-s-savior.pdf
    • http://www.gorillawalker.com/sword-song-alfred-the-great-4-by-cornwell-bernard-reissue.pdf
    • http://www.gorillawalker.com/3d-origami-step-by-step-illustrations.pdf
    • http://www.gorillawalker.com/cacao-a-manual-on-the-cultivation-and-curing-of-cacao.pdf
    • http://www.gorillawalker.com/design-of-small-dams-water-resources-technical-publication-series.pdf
    • http://www.gorillawalker.com/dragon-s-redemption-dragon-lore-book-two-dragon-lore-book.pdf
    • http://www.gorillawalker.com/unbridled-and-unforbidden-prequel-to-the-double-rider-men-s.pdf
    • http://www.gorillawalker.com/the-multiple-functions-of-sensory-motor-representations-a-special-issue.pdf
    • http://www.gorillawalker.com/preqin-private-equity-compensation-and-employment-review-2010.pdf
    • http://www.gorillawalker.com/uncertain-knowledge-scepticism-relativism-and-doubt-in-the-middle-ages.pdf
    • http://www.gorillawalker.com/from-serra-to-sancho-music-and-pageantry-in-the-california.pdf
    • http://www.gorillawalker.com/essentials-of-paramedic-care-update-and-basic-arrhythmias-and-student.pdf
    • http://www.gorillawalker.com/discovering-england-from-one-inch-above-the-thames.pdf
    • http://www.gorillawalker.com/the-activator-method-2e.pdf
    • http://www.gorillawalker.com/wildfire-alert-disaster-alert.pdf
    • http://www.gorillawalker.com/britain-s-gulag-the-brutal-end-of-empire-in-kenya.pdf
    • http://www.gorillawalker.com/field-guide-to-butterflies-of-illinois.pdf
    • http://www.gorillawalker.com/art-models-3-life-nude-photos-for-the-visual-arts.pdf
    • http://www.gorillawalker.com/strong-minded-women-the-emergence-of-the-woman-suffrage-movement.pdf
    • http://www.gorillawalker.com/the-other-side-of-the-river-book-14-marti-talbott.pdf
    • http://www.gorillawalker.com/complete-guide-to-the-soviet-union.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.