Malicious PDF — malware analysis report

Static analysis result for SHA-256 089d6289660da2a7…

MALICIOUS

PDF

42.6 KB Created: 2019-03-19 10:57:03 +03:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.10)
MD5: 7dd436c70f1d5afffe7e22cdcba7c47d SHA-1: 203893572e22d5a124e1ef12dfc2fa7d95ebfb87 SHA-256: 089d6289660da2a729609fa19f20577852cb05d95b7fa2866c48374a763ef79b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files on the same domain, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or to distribute a large volume of content, potentially malicious. No scripts were extracted from this sample, and the document body was heavily obfuscated, making it difficult to determine a more specific intent beyond link distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/circuit-analysis-exam-file.pdf
    • http://www.gorillawalker.com/dances-with-waves-around-ireland-by-kayak.pdf
    • http://www.gorillawalker.com/the-documentary-history-of-the-ratification-of-the-constitution-volume.pdf
    • http://www.gorillawalker.com/the-james-booker-collection.pdf
    • http://www.gorillawalker.com/generations-apart.pdf
    • http://www.gorillawalker.com/resultados-extraordinarios-spanish-edition.pdf
    • http://www.gorillawalker.com/classical-solos-for-flute-vol-2-w-cd-rom-hal.pdf
    • http://www.gorillawalker.com/the-historie-of-scotland-volume-1.pdf
    • http://www.gorillawalker.com/unveiling-biblical-prophecy.pdf
    • http://www.gorillawalker.com/healing-verses-of-holy-quran-hadith.pdf
    • http://www.gorillawalker.com/making-master-guitars.pdf
    • http://www.gorillawalker.com/the-moody-blues-caught-live-5-etc-songs-performed-by.pdf
    • http://www.gorillawalker.com/practical-analysis-in-one-variable-undergraduate-texts-in-mathematics.pdf
    • http://www.gorillawalker.com/agile-project-management-in-easy-steps-for-speedy-results.pdf
    • http://www.gorillawalker.com/the-technologists-with-bonus-short-story-the-professor-s-assassin.pdf
    • http://www.gorillawalker.com/a-documentary-history-of-the-african-theatre.pdf
    • http://www.gorillawalker.com/top-tips-writing-a-cv-resume-follow-these-tips-and.pdf
    • http://www.gorillawalker.com/watercolor-go-with-the-flow.pdf
    • http://www.gorillawalker.com/chaco-fractal-architecture-mathematics-and-metaphor-at-the-dawn-of.pdf
    • http://www.gorillawalker.com/seventy-five-years-of-hirayama-asteroid-families-the-role-of.pdf
    • http://www.gorillawalker.com/the-briefcase-and-the-baby.pdf
    • http://www.gorillawalker.com/blood-traitors-the-true-saga-of-families-torn-apart-by.pdf
    • http://www.gorillawalker.com/footprint-new-zealand-handbook-the-travel-guide.pdf
    • http://www.gorillawalker.com/zombie-fallout.pdf
    • http://www.gorillawalker.com/how-to-be-your-own-herbal-pharmacist.pdf
    • http://www.gorillawalker.com/summa-theologiae-volume-14-divine-government-1a-103-109-summa.pdf
    • http://www.gorillawalker.com/a-beginner-s-introduction-to-ayurvedic-medicine-the-science-of.pdf
    • http://www.gorillawalker.com/the-gardener-horticulture-in-pakistan.pdf
    • http://www.gorillawalker.com/a-special-day-at-school.pdf
    • http://www.gorillawalker.com/his-to-control-boxed-set.pdf
    • http://www.gorillawalker.com/toroa-the-royal-albatross.pdf
    • http://www.gorillawalker.com/a-manual-of-select-medical-bibliography-in-which-the-books.pdf
    • http://www.gorillawalker.com/the-modern-magazine-visual-journalism-in-the-digital-era.pdf
    • http://www.gorillawalker.com/the-horseman-s-encyclopedia.pdf
    • http://www.gorillawalker.com/the-return-of-the-ragpicker.pdf
    • http://www.gorillawalker.com/timelinks-third-grade-communities-communities-student-edition-older-elementary-social.pdf
    • http://www.gorillawalker.com/red-skies.pdf
    • http://www.gorillawalker.com/more-tactical-reality-why-there-s-no-such-thing-as.pdf
    • http://www.gorillawalker.com/some-problems-of-life-paperback.pdf
    • http://www.gorillawalker.com/other-objects-of-desire-collectors-and-collecting-queerly.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.