Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a28690c9a4fb5b2…

MALICIOUS

PDF

44.1 KB Created: 2019-01-06 08:14:35 +03:00 Authoring application: Acrobat PDFMaker 11 for Word (via Acrobat Distiller 11.0 (Windows))
MD5: 67d84577a82764bd68c12791bf1f24b2 SHA-1: 536b34fdbcbe588827b00cec37162f2a779dc771 SHA-256: 0a28690c9a4fb5b2b9a37d44810d0ffae9c8b26ae47e71e5542e5aac9143200a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious. The embedded URLs point to a single domain, suggesting a coordinated effort to manipulate search engine results or distribute content from a central location.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/joel-osteen-quotes-365-days-of-inspirational-and-motivational-quotes.pdf
    • http://www.gorillawalker.com/samuel-pufendorf-s-on-the-natural-state-of-men-studies.pdf
    • http://www.gorillawalker.com/the-book-and-the-sword-the-martial-arts-novels-of.pdf
    • http://www.gorillawalker.com/conditions-poems.pdf
    • http://www.gorillawalker.com/build-your-own-stone-house-using-the-easy-slipform-method.pdf
    • http://www.gorillawalker.com/cmos-vlsi-design-vlsi-cad-lab-man-pkg.pdf
    • http://www.gorillawalker.com/understanding-sustainable-cities-concepts-cases-and-solutions.pdf
    • http://www.gorillawalker.com/byodo-japan-name-architectural-photography-anthology-1992-isbn-4106026228-japanese.pdf
    • http://www.gorillawalker.com/roman-auxiliary-forts-27-bc-ad-378-fortress.pdf
    • http://www.gorillawalker.com/the-campaign-of-trafalgar-volume-1.pdf
    • http://www.gorillawalker.com/thinking-about-social-thinking.pdf
    • http://www.gorillawalker.com/where-are-the-dead.pdf
    • http://www.gorillawalker.com/how-to-attract-money-with-meditation-slow-and-difficult-steps.pdf
    • http://www.gorillawalker.com/bangor-maine-a-net-guides-travel-guide-kindle-edition.pdf
    • http://www.gorillawalker.com/hiking-trails-of-the-cohutta-and-big-frog-wildernesses.pdf
    • http://www.gorillawalker.com/the-hollow-man.pdf
    • http://www.gorillawalker.com/bobby-robson-high-noon-a-year-at-barcelona.pdf
    • http://www.gorillawalker.com/dartmoor-leisure-walks-for-all-ages-pathfinder-short-walks.pdf
    • http://www.gorillawalker.com/famous-castles-kindle-edition.pdf
    • http://www.gorillawalker.com/i-o-stats-primer-for-aamodt-s-industrial-organizational-psychology.pdf
    • http://www.gorillawalker.com/diccionario-de-los-suenos-esoterismo-spanish-edition.pdf
    • http://www.gorillawalker.com/paleo-snacks-that-make-the-paleo-diet-easier-kindle-edition.pdf
    • http://www.gorillawalker.com/warrior-wisdom-ageless-wisdom-for-the-modern-warrior-updated-2nd.pdf
    • http://www.gorillawalker.com/the-night-watcher.pdf
    • http://www.gorillawalker.com/thermische-turbomaschinen-ge-nderte-betriebsbedingungen-regelung-mechanische-probleme-temperaturprobleme-klassiker.pdf
    • http://www.gorillawalker.com/modelling-and-control-of-dialysis-systems-volume-1-modeling-techniques.pdf
    • http://www.gorillawalker.com/myeloma-therapy-pursuing-the-plasma-cell-contemporary-hematology.pdf
    • http://www.gorillawalker.com/48-famous-studies-1st-and-3rd-part-oboe.pdf
    • http://www.gorillawalker.com/handbuch-altenpflege.pdf
    • http://www.gorillawalker.com/daily-telegraph-guide-to-parenting-and-the-law.pdf
    • http://www.gorillawalker.com/oral-and-maxillofacial-pathology-a-rationale-for-diagnosis-and-treatment.pdf
    • http://www.gorillawalker.com/downsizing-bei-verbrennungsmotoren-ein-wirkungsvolles-konzept-zur-kraftstoffverbrauchssenkung-vdi-buch.pdf
    • http://www.gorillawalker.com/bitumens-asphalts-and-tar-sands-developments-in-petroleum-science.pdf
    • http://www.gorillawalker.com/rush-revere-and-the-american-revolution-time-travel-adventures-with.pdf
    • http://www.gorillawalker.com/all-electric-plant-gets-world-class-results-strategies-an-article.pdf
    • http://www.gorillawalker.com/danish-home-baking.pdf
    • http://www.gorillawalker.com/black-is-the-new-green-marketing-to-affluent-african-americans.pdf
    • http://www.gorillawalker.com/piazzolla-ten-favorite-tunes-jazz-play-along-series-volume-188.pdf
    • http://www.gorillawalker.com/topics-in-modal-analysis-ii-volume-6-proceedings-of-the.pdf
    • http://www.gorillawalker.com/treasury-of-norse-mythology-stories-of-intrigue-trickery-love-and.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.