Malicious PDF — malware analysis report

Static analysis result for SHA-256 0691837c60ae998f…

MALICIOUS

PDF

46.3 KB Created: 2018-12-15 08:53:45 +03:00 Authoring application: - (via Acrobat Distiller Daemon 3.0 for Solaris 2.3 and later (SPARC))
MD5: b367ba5a2b1f3db964e53b31a1c1db76 SHA-1: d82f83f2ee199b26706e761b860b5211ea0d3a42 SHA-256: 0691837c60ae998ffb27812119a752b7eca8360e815fb49fa0a11d3d31fe5039
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a link farm, potentially for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/chinese-cooking-classic-hunan-style-steamed-dishes-chinese-jingdian-xiangcai.pdf
    • http://www.gorillawalker.com/la-cambiale-di-matrimonio-terzetto-quell-amabile-visino-soprano-tenor.pdf
    • http://www.gorillawalker.com/wide-gap-luminescent-materials-theory-and-applications-electronic-materials-science.pdf
    • http://www.gorillawalker.com/an-amish-family-christmas.pdf
    • http://www.gorillawalker.com/mental-diving-leichter-tauchen-lernen-durch-mentales-training-german-edition.pdf
    • http://www.gorillawalker.com/axes-of-evil-the-true-story-of-the-ax-man.pdf
    • http://www.gorillawalker.com/defects-and-defect-processes-in-nonmetallic-solids.pdf
    • http://www.gorillawalker.com/siu-nim-tau-little-idea-the-first-wing-tsun-wing.pdf
    • http://www.gorillawalker.com/the-illustrated-room-20th-century-interior-design-rendering.pdf
    • http://www.gorillawalker.com/war-and-economy-in-the-third-reich.pdf
    • http://www.gorillawalker.com/age-spots-with-dementia-sometimes-the-truth-is-only-skin.pdf
    • http://www.gorillawalker.com/customer-loyalty-top-strategies-for-increasing-your-company-s-bottom.pdf
    • http://www.gorillawalker.com/federal-manager-s-handbook-guide-to-rehabilitating-or-removing-the.pdf
    • http://www.gorillawalker.com/nonviolent-action-what-christian-ethics-demands-but-most-christians-have.pdf
    • http://www.gorillawalker.com/nurture.pdf
    • http://www.gorillawalker.com/honda-the-early-classic-motorcycles.pdf
    • http://www.gorillawalker.com/microsoft-access-2010-comprehensive-sam-2010-compatible-products.pdf
    • http://www.gorillawalker.com/the-kaiser-s-holocaust-germany-s-forgotten-genocide-and-the.pdf
    • http://www.gorillawalker.com/extreme-programming-and-agile-processes-in-software-engineering-7th-international.pdf
    • http://www.gorillawalker.com/new-research-on-personality-disorders.pdf
    • http://www.gorillawalker.com/real-gardens-grow-natives-design-plant-and-enjoy-a-healthy.pdf
    • http://www.gorillawalker.com/better-people-leader-the-pb.pdf
    • http://www.gorillawalker.com/reserves-virginia-regimental-histories-series.pdf
    • http://www.gorillawalker.com/the-sovereign-state-and-its-competitors-an-analysis-of-systems.pdf
    • http://www.gorillawalker.com/laruelle-and-non-philosophy-critical-connections.pdf
    • http://www.gorillawalker.com/talking-with-artists.pdf
    • http://www.gorillawalker.com/killian-the-avalon-series-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/understanding-muslim-teachings-and-traditions-a-guide-for-christians.pdf
    • http://www.gorillawalker.com/pilates-everything-you-need-to-know-about.pdf
    • http://www.gorillawalker.com/maximizing-profitability-with-safety-culture-development.pdf
    • http://www.gorillawalker.com/laser-and-coherence-spectroscopy.pdf
    • http://www.gorillawalker.com/the-letters-of-j-r-r-tolkien.pdf
    • http://www.gorillawalker.com/corrections-a-text-reader-sage-text-reader-series-in-criminology.pdf
    • http://www.gorillawalker.com/noah-and-the-big-boat-the-beginner-s-bible.pdf
    • http://www.gorillawalker.com/cooking-for-geeks-real-science-great-hacks-and-good-food.pdf
    • http://www.gorillawalker.com/concerto-for-orchestra-op38-study-score.pdf
    • http://www.gorillawalker.com/how-to-make-money-online-the-ultimate-passive-income-blueprint.pdf
    • http://www.gorillawalker.com/aromatherapy-subtle-energy-techniques-compassionate-healing-with-essential-oils-first.pdf
    • http://www.gorillawalker.com/jane-s-world-railways-1996-97-serial.pdf
    • http://www.gorillawalker.com/2010-cfa-level-3-book-4-alternative-investments-risk-management.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.