Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e782fa5651024c8…

MALICIOUS

PDF

43.4 KB Created: 2018-11-15 18:34:16 +03:00 Authoring application: Adobe PageMaker 6.5 (via Acrobat Distiller 3.0 for Windows)
MD5: 31494126eaea59aaa6059a354755ddbd SHA-1: fe88a7b2e31272c915cb41a033f11ed8d1e2f20a SHA-256: 0e782fa5651024c8341a2e28bba44e74d111e2456ffaffb15e52a5ba10bc7301
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The embedded URLs point to various PDF files on the same domain, suggesting a link farm or content distribution strategy. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/expectant-parents-workshop-devotional-volume-1.pdf
    • http://www.gorillawalker.com/compendio-de-avionica-digital-tomo-2-spanish-edition.pdf
    • http://www.gorillawalker.com/unwrapping-the-servant-teaching-kids-to-serve-jesus-and-others.pdf
    • http://www.gorillawalker.com/hothouse-flower-calloway-sisters-volume-2.pdf
    • http://www.gorillawalker.com/connected-mathematics-cmp-variables-and-patterns-student-edition.pdf
    • http://www.gorillawalker.com/world-s-shortest-stories-of-love-and-death.pdf
    • http://www.gorillawalker.com/recognition-the-key-to-identity.pdf
    • http://www.gorillawalker.com/a-restless-past-history-and-the-american-public.pdf
    • http://www.gorillawalker.com/miniauto-collectors-9-miniauto-collectors-series.pdf
    • http://www.gorillawalker.com/the-adobe-photoshop-cc-professional-tutorial-book-60-macintosh-windows.pdf
    • http://www.gorillawalker.com/soliman-s-three-phase-hand-acupuncture-textbook.pdf
    • http://www.gorillawalker.com/the-hidden-history-of-the-tibetan-book-of-the-dead.pdf
    • http://www.gorillawalker.com/the-language-of-influence.pdf
    • http://www.gorillawalker.com/stones-of-silence-journeys-in-the-himalaya.pdf
    • http://www.gorillawalker.com/under-the-mistletoe-children-s-poetry-picture-book-kindle-edition.pdf
    • http://www.gorillawalker.com/what-we-believe-kindle-edition.pdf
    • http://www.gorillawalker.com/legislative-party-campaign-committees-in-the-american-states-comparative-legislative.pdf
    • http://www.gorillawalker.com/tax-planning-for-family-and-owner-managed-companies-2011-12.pdf
    • http://www.gorillawalker.com/advances-in-inorganic-chemistry-volume-54-inorganic-reaction-mechanisms.pdf
    • http://www.gorillawalker.com/hollywood-royalty-hepburn-davis-stewart-and-friends-at-the-dinner.pdf
    • http://www.gorillawalker.com/new-american-standard-bible.pdf
    • http://www.gorillawalker.com/17-hours-to-glory-extraordinary-stories-from-the-heart-of.pdf
    • http://www.gorillawalker.com/the-sentimental-citizen-emotion-in-democratic-politics.pdf
    • http://www.gorillawalker.com/o-connor-violin-method-book-i-and-cd.pdf
    • http://www.gorillawalker.com/sweet-sixteen-buffy-the-vampire-slayer-pocket-paperback-unnumbered-mass.pdf
    • http://www.gorillawalker.com/speech-audio-image-and-biomedical-signal-processing-using-neural-networks.pdf
    • http://www.gorillawalker.com/silent-night-cards-with-envelope.pdf
    • http://www.gorillawalker.com/bulletproof-diet-smoothies-quick-and-easy-bulletproof-diet-recipes-to.pdf
    • http://www.gorillawalker.com/warning-miracle-kindle-edition.pdf
    • http://www.gorillawalker.com/khul-khaal-five-egyptian-women-tell-their-stories-contemporary-issues.pdf
    • http://www.gorillawalker.com/beauty-and-the-highlander-moriag-series-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/the-orvis-guide-to-fly-fishing-for-carp-tips-and.pdf
    • http://www.gorillawalker.com/introduction-to-frustrated-magnetism-materials-experiments-theory-springer-series-in.pdf
    • http://www.gorillawalker.com/falconry.pdf
    • http://www.gorillawalker.com/the-odyssey-of-korean-democracy-korean-politics-1987-1990.pdf
    • http://www.gorillawalker.com/asylum-seekers-changing-face-of-north-america.pdf
    • http://www.gorillawalker.com/shaping-gender-policy-in-turkey-grassroots-women-activists-the-european.pdf
    • http://www.gorillawalker.com/el-can-bal-de-la-guerrero-y-otros-demonios-de.pdf
    • http://www.gorillawalker.com/nine-mil.pdf
    • http://www.gorillawalker.com/the-sundered-arms-dungeons-dragons-novel.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.