Malicious PDF — malware analysis report

Static analysis result for SHA-256 072955d090850614…

MALICIOUS

PDF

33.8 KB Created: 2020-02-20 05:10:08 +03:00 Authoring application: LaTeX with hyperref and pdfscreen (via Mac OS X 10.5.7 Quartz PDFContext)
MD5: 3d3ffcac820a2a02b8d8369cadd82f27 SHA-1: 245f47cab8557716ab0fc217259c71c95753a00a SHA-256: 072955d09085061494f1490b6ed9f49505894d7eed50ab46b12aeecbfa6417c9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF documents hosted on the same domain, suggesting a link farm or SEO manipulation tactic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern beyond the link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/generation-youtube-breaking-down-social-media-kindle-edition.pdf
    • http://www.gorillawalker.com/creative-illustration-beyond-inspiring-tips-techniques-and-ideas-for-transforming.pdf
    • http://www.gorillawalker.com/critical-race-theory-2nd-ed.pdf
    • http://www.gorillawalker.com/how-to-draw-101-animals.pdf
    • http://www.gorillawalker.com/clinical-microbiology-and-infectious-diseases-an-illustrated-colour-text-2e.pdf
    • http://www.gorillawalker.com/the-sun-is-feminine-a-study-on-language-acquisition-in.pdf
    • http://www.gorillawalker.com/egypt-before-the-pharaohs-the-prehistoric-foundations-of-egyptian-civilization.pdf
    • http://www.gorillawalker.com/the-living-tradition-of-maria-martinez.pdf
    • http://www.gorillawalker.com/a-book-of-dreams.pdf
    • http://www.gorillawalker.com/fundamentals-of-engineering-economics.pdf
    • http://www.gorillawalker.com/band-aid-for-a-broken-leg-being-a-doctor-with.pdf
    • http://www.gorillawalker.com/visions-and-revisions-kindle-edition.pdf
    • http://www.gorillawalker.com/immaculate-reception-a-madeline-bean-culinary-mystery.pdf
    • http://www.gorillawalker.com/price-of-liberty-baha-ye-rahaei-adabiyat-i-farsi-ruman.pdf
    • http://www.gorillawalker.com/computer-music-special-52-2012-singer-songwriter-production-guide.pdf
    • http://www.gorillawalker.com/corporate-escape-the-rise-of-the-new-entrepreneur.pdf
    • http://www.gorillawalker.com/nydam-mosefund-1859-1863-primary-source-edition-danish-edition.pdf
    • http://www.gorillawalker.com/fully-alive-the-daily-path-of-christian-meditation.pdf
    • http://www.gorillawalker.com/identities-across-media-and-modes-discursive-perspectives-linguistic-insights-studies.pdf
    • http://www.gorillawalker.com/backroads-byways-of-minnesota-drives-day-trips-weekend-excursions-backroads.pdf
    • http://www.gorillawalker.com/airline-safety-an-annotated-bibliography-bibliographies-and-indexes-in-psychology.pdf
    • http://www.gorillawalker.com/the-life-of-holiness-notes-and-reflections-on-romans-1.pdf
    • http://www.gorillawalker.com/computational-techniques-for-complex-transport-phenomena.pdf
    • http://www.gorillawalker.com/chicken-soup-for-the-kid-s-soul-2-read-aloud.pdf
    • http://www.gorillawalker.com/time-and-the-gods-millennium-fantasy-masterworks.pdf
    • http://www.gorillawalker.com/the-whole-brain-child-12-revolutionary-strategies-to-nurture-your.pdf
    • http://www.gorillawalker.com/uruk-the-first-city-of-the-ancient-world.pdf
    • http://www.gorillawalker.com/combat-photographer-vietnam-experience.pdf
    • http://www.gorillawalker.com/protect-your-estate-a-personal-guide-to-intelligent-estate-planning.pdf
    • http://www.gorillawalker.com/primer-y-segundo-viaje-a-misiones-por-juan-bautista-ambrosetti.pdf
    • http://www.gorillawalker.com/le-pmu-pour-les-d.pdf
    • http://www.gorillawalker.com/the-world-s-wit-and-humor-an-encyclopedia-of-the.pdf
    • http://www.gorillawalker.com/fred-markham-in-russia-or-the-boy-travellers-in-the.pdf
    • http://www.gorillawalker.com/louisville-nashville-diesel-locomotives.pdf
    • http://www.gorillawalker.com/red-rocks-select.pdf
    • http://www.gorillawalker.com/rod-stewart-guitar-anthology-guitar-recorded-versions.pdf
    • http://www.gorillawalker.com/the-lean-mindset-ask-the-right-questions.pdf
    • http://www.gorillawalker.com/survivor-moms-women-s-stories-of-birthing-mothering-and-healing.pdf
    • http://www.gorillawalker.com/keystone-2013-workbook-building-bridges.pdf
    • http://www.gorillawalker.com/the-art-of-awareness-how-observation-can-transform-your-teaching.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.