Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f3a44dae3647cd5…

MALICIOUS

PDF

44.8 KB Created: 2018-11-26 08:20:38 +03:00 Authoring application: - (via PDFlib Personalization Server 5.0.1 (COM/Win32) unlicensed)
MD5: 6385030669f92a243ba25b73f3cd8d4c SHA-1: cc439b4fabcb7660f7b50a08889a24de466895fa SHA-256: 0f3a44dae3647cd5ca4f827d9ce67f5117192378017fb6b21d9813ef1de7a1e9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern observed is the attempt to direct users to a wide array of external websites, likely for SEO manipulation or to host malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-cloud-people-a-lost-civilization-in-the-upper-amazon.pdf
    • http://www.gorillawalker.com/to-disco-with-love-the-records-that-defined-an-era.pdf
    • http://www.gorillawalker.com/the-stranger-who-bore-me-adoptee-birth-mother-relationships.pdf
    • http://www.gorillawalker.com/nature-inside-out-a-leader-s-guide-to-nature-education.pdf
    • http://www.gorillawalker.com/the-bolingbroke-chit-a-regency-romance-love-takes-root-book.pdf
    • http://www.gorillawalker.com/morocco-half-title-peeps-at-many-lands.pdf
    • http://www.gorillawalker.com/the-cuban-revolution-world-history-series.pdf
    • http://www.gorillawalker.com/scale-uses-only-protons-mass-to-predict-the-covalent-radius.pdf
    • http://www.gorillawalker.com/gloucester-cheltenham-and-stroud-explorer-maps.pdf
    • http://www.gorillawalker.com/reclaiming-our-prodigal-sons-and-daughters-a-practical-approach-for.pdf
    • http://www.gorillawalker.com/medical-wisdom-and-doctoring-the-art-of-21st-century-practice.pdf
    • http://www.gorillawalker.com/beginner-day-trader-high-profit-day-trading-bible-easiest-fastest.pdf
    • http://www.gorillawalker.com/nonqualified-deferred-compensation-answer-book.pdf
    • http://www.gorillawalker.com/nagele-revisited.pdf
    • http://www.gorillawalker.com/ryan-pravus-volume-5.pdf
    • http://www.gorillawalker.com/they-really-like-me.pdf
    • http://www.gorillawalker.com/an-alien-affair-mission-earth-volume-4.pdf
    • http://www.gorillawalker.com/a-logical-introduction-to-proof.pdf
    • http://www.gorillawalker.com/rosa-s-bus-the-ride-to-civil-rights.pdf
    • http://www.gorillawalker.com/algo-raro-y-precioso-el-affaire-blackstone-iv-spanish-edition.pdf
    • http://www.gorillawalker.com/doktor-und-apotheker-komische-oper-in-zwei-aufz-gen-german.pdf
    • http://www.gorillawalker.com/tennis-in-action-sports-in-action.pdf
    • http://www.gorillawalker.com/keys-for-living-single.pdf
    • http://www.gorillawalker.com/cirque-du-freak-the-manga-vol-11-lord-of-the.pdf
    • http://www.gorillawalker.com/philip-s-street-atlas-west-yorkshire-philip-s-street-atlases.pdf
    • http://www.gorillawalker.com/sacred-sexuality-the-perfumed-garden-of-the-shaykh-nefwazi.pdf
    • http://www.gorillawalker.com/organisational-anthropology-doing-ethnography-in-and-among-complex-organisations-anthropology.pdf
    • http://www.gorillawalker.com/a-feast-of-meanings-eucharistic-theologies-from-jesus-through-johannine.pdf
    • http://www.gorillawalker.com/el-secreto-del-castillo-de-cant.pdf
    • http://www.gorillawalker.com/bidrag-til-den-norske-kirkes-historie-i-det-nittende-aarhundrede.pdf
    • http://www.gorillawalker.com/have-gun-will-travel-tv-milestones-series.pdf
    • http://www.gorillawalker.com/image-guided-radiation-therapy-of-lung-cancer-chinese-edition.pdf
    • http://www.gorillawalker.com/cisco-ccna-routing-and-switching-icnd2-200-101-official-cert.pdf
    • http://www.gorillawalker.com/hellenic-temples-and-christian-churches-a-concise-history-of-the.pdf
    • http://www.gorillawalker.com/automobile-electronics-and-basic-electrical-systems-practice-manual.pdf
    • http://www.gorillawalker.com/alcohols-and-esters-volume-volume-3-second-edition-ethel-browning.pdf
    • http://www.gorillawalker.com/attack-of-the-energy-vampire-glow-in-the-dark-sticker.pdf
    • http://www.gorillawalker.com/cowboy-trouble-bear-county-10-siren-publishing-the-lynn-hagen.pdf
    • http://www.gorillawalker.com/oracle-forms-developer-s-handbook.pdf
    • http://www.gorillawalker.com/the-magic-of-the-state.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.