Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a541933b3048b2c…

MALICIOUS

PDF

43.1 KB Created: 2019-03-16 14:22:38 +03:00 Authoring application: Adobe InDesign CS4 (6.0.6) (via Adobe PDF Library 9.0)
MD5: 7d1f1cf6cfc039d5a4e9aa4c94ac2c23 SHA-1: f94a492fe80926c07d416abbb6e7fe129bf409f2 SHA-256: 0a541933b3048b2c5b16fde7e7e32d31251214a69f93a8e8506de84334404b52
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files on the same domain, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. This suggests the document is designed to manipulate search engine results or act as a gateway to distribute more content. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern beyond the link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/a-many-colored-kingdom-multicultural-dynamics-for-spiritual-formation.pdf
    • http://www.gorillawalker.com/washington-indians-paperback-native-american-heritage.pdf
    • http://www.gorillawalker.com/constitutional-conventions-in-australia.pdf
    • http://www.gorillawalker.com/principles-of-quantum-mechanics-as-applied-to-chemistry-and-chemical.pdf
    • http://www.gorillawalker.com/ride-me-cowboy-erotic-tales-of-the-west.pdf
    • http://www.gorillawalker.com/travel-journal-my-trip-to-maldives.pdf
    • http://www.gorillawalker.com/zits-2010-day-to-day-calendar.pdf
    • http://www.gorillawalker.com/molecular-dynamics-and-structure-of-solids.pdf
    • http://www.gorillawalker.com/health-education-in-rural-schools.pdf
    • http://www.gorillawalker.com/dynamic-economics-optimization-by-the-lagrange-method.pdf
    • http://www.gorillawalker.com/golf-a-tribute-v-1-europe.pdf
    • http://www.gorillawalker.com/vegan-survival-guide-to-austin-american-palate.pdf
    • http://www.gorillawalker.com/heal-leaky-gut-syndrome-a-practical-guide-on-treating-leaky.pdf
    • http://www.gorillawalker.com/mastering-secured-transactions-ucc-article-9-second-edition-carolina-aademic.pdf
    • http://www.gorillawalker.com/dawn-of-dragons-the-complete-trilogy.pdf
    • http://www.gorillawalker.com/current-issues-in-lesbian-gay-bisexual-and-transgender-health.pdf
    • http://www.gorillawalker.com/of-passionate-intensity-right-wing-populism-and-the-reform-party.pdf
    • http://www.gorillawalker.com/patios-designs-for-living.pdf
    • http://www.gorillawalker.com/mathematics-and-plausible-inference-volume-i-induction-and-analogy-in.pdf
    • http://www.gorillawalker.com/headshot-diva-why-your-business-profile-affects-your-bottom-line.pdf
    • http://www.gorillawalker.com/diagnostic-imaging-spine-1e.pdf
    • http://www.gorillawalker.com/geomorphology-of-the-cold-enviroments.pdf
    • http://www.gorillawalker.com/food-and-flowers-for-all-seasons.pdf
    • http://www.gorillawalker.com/techniques-of-propaganda-and-persuasion.pdf
    • http://www.gorillawalker.com/holt-algebra-with-trigonometry-annotated-teacher-s-edition.pdf
    • http://www.gorillawalker.com/information-system-a-managers-guide-to-harnessing-technology.pdf
    • http://www.gorillawalker.com/civil-procedure-sparkcharts.pdf
    • http://www.gorillawalker.com/interpreting-the-prophets-reading-understanding-and-preaching-from-the-worlds.pdf
    • http://www.gorillawalker.com/dan-and-the-shard-of-ice-quicksilver.pdf
    • http://www.gorillawalker.com/becker-s-world-of-the-cell-technoloy-update-olp-with.pdf
    • http://www.gorillawalker.com/transformation-outsourcing.pdf
    • http://www.gorillawalker.com/virginia-contractor-s-business-and-law-practice-exam.pdf
    • http://www.gorillawalker.com/tyler-inked-brotherhood-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/flames-beyond-gettysburg-the-confederate-expedition-to-the-susquehanna-river.pdf
    • http://www.gorillawalker.com/malditos-bastardos-inglourious-bastards-spanish-edition.pdf
    • http://www.gorillawalker.com/arpeggio-studies-in-three-octaves-for-the-cello.pdf
    • http://www.gorillawalker.com/integrated-circuit-engineering-design-fabrication-and-applications.pdf
    • http://www.gorillawalker.com/john-singer-sargent-figures-and-landscapes-1874-1882-complete-paintings.pdf
    • http://www.gorillawalker.com/criminal-imports-gideon-of-scotland-yard-kindle-edition.pdf
    • http://www.gorillawalker.com/serial-vigilante-training-in-new-orleans-kindle-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.