Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c627f8e65dfcd69…

MALICIOUS

PDF

41.3 KB Created: 2018-11-30 20:30:32 +03:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.17)
MD5: ef18cec7cf01b3e665a5928a7e982b35 SHA-1: 821c442a9001264e4ea7e433dc3720c3d2a31c16 SHA-256: 0c627f8e65dfcd692a4197847778f645b25364420a989207febfb1f0bd260bf8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as detected by the PDF_SEO_LINK_FARM heuristic. While no scripts were explicitly extracted, the ML_NYX_PDF_MALICIOUS heuristic indicates a high probability of malicious intent. The embedded URLs suggest an attempt to manipulate search engine results or distribute content from a specific domain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/no-control-male-domination-female-submission-mind-control-abduction-erotica.pdf
    • http://www.gorillawalker.com/the-rough-guide-to-the-czech-slovak-republics-7-rough.pdf
    • http://www.gorillawalker.com/love-dishonor-marry-die-cherish-perish-a-novel.pdf
    • http://www.gorillawalker.com/the-resilient-manager-navigating-the-challenges-of-working-life.pdf
    • http://www.gorillawalker.com/necropolis.pdf
    • http://www.gorillawalker.com/basiswissen-medizinische-mikrobiologie-und-infektiologie-springer-lehrbuch-german-edition.pdf
    • http://www.gorillawalker.com/2008-safety-management-knowledge-q-a-with-questions-succinctly-and.pdf
    • http://www.gorillawalker.com/art-and-truth-after-plato.pdf
    • http://www.gorillawalker.com/in-the-spirit-of-hegel.pdf
    • http://www.gorillawalker.com/a-botswana-traveler-s-companion-english-setswana-phrase-book.pdf
    • http://www.gorillawalker.com/the-exploits-of-the-second-mrs-watson.pdf
    • http://www.gorillawalker.com/scrabble-brd-2.pdf
    • http://www.gorillawalker.com/images-of-power-images-of-san-rock-art.pdf
    • http://www.gorillawalker.com/last-man-in-the-end-of-empire-in-northern-nigeria.pdf
    • http://www.gorillawalker.com/how-to-play-and-win-at-craps-how-to-make.pdf
    • http://www.gorillawalker.com/sit-stay-speak-a-novel.pdf
    • http://www.gorillawalker.com/north-american-bird-i-d-checklist.pdf
    • http://www.gorillawalker.com/anxiety-at-35-000-feet-an-introduction-to-clinical-aerospace.pdf
    • http://www.gorillawalker.com/the-treatment-of-psoriasis.pdf
    • http://www.gorillawalker.com/wind-energy-in-the-21st-century-economics-policy-technology-and.pdf
    • http://www.gorillawalker.com/dead-shot-a-cal-murphy-thriller-volume-1.pdf
    • http://www.gorillawalker.com/grandma-paints-bear-hugs-jelly-beans.pdf
    • http://www.gorillawalker.com/5-minute-feasts-stir-fry-gourmet-cooking-for-two.pdf
    • http://www.gorillawalker.com/reluctant-father.pdf
    • http://www.gorillawalker.com/winter-camp.pdf
    • http://www.gorillawalker.com/educating-the-chinese-individual-life-in-a-rural-boarding-school.pdf
    • http://www.gorillawalker.com/words-to-winners-of-souls.pdf
    • http://www.gorillawalker.com/artisanal-gluten-free-cupcakes-from-scratch-recipes-to-delight-every.pdf
    • http://www.gorillawalker.com/holt-science-technology-short-course-pe-hs-t-h-water.pdf
    • http://www.gorillawalker.com/jinn-a-novel.pdf
    • http://www.gorillawalker.com/candy-cane-kisses-and-enchanted-embraces-10-holiday-romances-by.pdf
    • http://www.gorillawalker.com/medical-parasitology-exam-guide-chinese-edition.pdf
    • http://www.gorillawalker.com/telemarketing-success.pdf
    • http://www.gorillawalker.com/iec-60099-5-ed-1-1-b-2000-surge-arresters.pdf
    • http://www.gorillawalker.com/everyday-diary-and-notebook-2016.pdf
    • http://www.gorillawalker.com/giotto-the-crucifix-in-santa-maria-novella.pdf
    • http://www.gorillawalker.com/modern-irish-poetry-an-anthology.pdf
    • http://www.gorillawalker.com/sun-valley-images-2015-wall-calendar.pdf
    • http://www.gorillawalker.com/cocoa-programming.pdf
    • http://www.gorillawalker.com/because-of-grace-the-grace-series-book-2-kindle-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.