Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ed42fe1b987f175…

MALICIOUS

PDF

42.9 KB Created: 2018-11-23 21:32:24 +03:00 Authoring application: Adobe InDesign CS6 (Macintosh) (via Adobe PDF Library 10.0.1)
MD5: 81984d9c3cab3ba3a8bf3293bcfafe31 SHA-1: f7a3044ae36eb1d99c69efcc7d1cb6fed0b3e3d8 SHA-256: 0ed42fe1b987f1756b0d098b16454ee9cf46f15bcb18563abfe710cf3132c915
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a link farm, likely for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/w-kregu-strasburga-z-peregrynacji-mlodziezy-z-rzeczypospolitej-polsko-litewskiej.pdf
    • http://www.gorillawalker.com/garden-design-the-complete-practical-guide-to-planning-styling-and.pdf
    • http://www.gorillawalker.com/input-output-in-parallel-and-distributed-computer-systems-the-springer.pdf
    • http://www.gorillawalker.com/delhi-city-map-guidebooks.pdf
    • http://www.gorillawalker.com/left-behind-left-behind-book-1-abridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/drama-on-drama-dimensions-of-theatricality-on-the-contemporary-british.pdf
    • http://www.gorillawalker.com/wound-and-skin-care-reference-guide.pdf
    • http://www.gorillawalker.com/skill-checklists-for-fundamentals-of-nursing-the-art-and-science.pdf
    • http://www.gorillawalker.com/dimensioning-and-tolerancing-asme-y14-5m-1994-engineering-drawing-and.pdf
    • http://www.gorillawalker.com/poacher-panic-wild-rescue.pdf
    • http://www.gorillawalker.com/office-2016-for-seniors-for-dummies-for-dummies-computer-tech.pdf
    • http://www.gorillawalker.com/ally-versus-ally-america-europe-and-the-siberian-pipeline-crisis.pdf
    • http://www.gorillawalker.com/the-unaccompanied-solo-violin-repertory-before-1750-klagenfurt-manuscript-dances.pdf
    • http://www.gorillawalker.com/the-folklore-of-the-freeway-race-and-revolt-in-the.pdf
    • http://www.gorillawalker.com/ground.pdf
    • http://www.gorillawalker.com/the-car-crash-manual-after-the-crash-navigating-the-maze.pdf
    • http://www.gorillawalker.com/epidemiology-for-the-uninitiated.pdf
    • http://www.gorillawalker.com/school-spirits-hex-hall-novel-a.pdf
    • http://www.gorillawalker.com/iso-3951-1-2005-sampling-procedures-for-inspection-by-variables.pdf
    • http://www.gorillawalker.com/drug-information-handbook-for-nursing.pdf
    • http://www.gorillawalker.com/vietnam-uk-version-a-photographic-journey-through-fascinating-vietnam-calvendo.pdf
    • http://www.gorillawalker.com/bullet-point.pdf
    • http://www.gorillawalker.com/the-dandy-book-annual-2007.pdf
    • http://www.gorillawalker.com/integrating-science-and-language-arts-in-your-classroom.pdf
    • http://www.gorillawalker.com/study-and-master-mathematics-grade-12-learner-book.pdf
    • http://www.gorillawalker.com/bittersweet-california-historical-series-2.pdf
    • http://www.gorillawalker.com/natural-climbing-sites-ign-grey.pdf
    • http://www.gorillawalker.com/wisdom-of-the-peaceful-warrior-deck-52-inspiration-cards.pdf
    • http://www.gorillawalker.com/oraciones-y-promesas-para-las-mujeres-spanish-edition.pdf
    • http://www.gorillawalker.com/predicting-pick-3-to-win.pdf
    • http://www.gorillawalker.com/new-york-road-runners-complete-book-of-running-and-fitness.pdf
    • http://www.gorillawalker.com/how-to-succeed-as-a-trial-lawyer.pdf
    • http://www.gorillawalker.com/multiscale-modeling-of-pedestrian-dynamics-ms-a.pdf
    • http://www.gorillawalker.com/the-art-of-throwing-weapons-exotic-weapons.pdf
    • http://www.gorillawalker.com/not-for-tourists-guide-to-seattle.pdf
    • http://www.gorillawalker.com/las-iglesias-coloniales-de-yucat-n-tomo-ii-valladolid-y.pdf
    • http://www.gorillawalker.com/hymns-and-homilies-of-st-ephraim-the-syrian-kindle-edition.pdf
    • http://www.gorillawalker.com/conversations-with-god-book-one.pdf
    • http://www.gorillawalker.com/one-nation-indivisible-ethnic-interest-groups-and-u-s-foreign.pdf
    • http://www.gorillawalker.com/radar-and-ais-integrated-bridge-systems.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.