Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f6e88fdefe760e2…

MALICIOUS

PDF

43.0 KB Created: 2018-11-26 20:05:53 +03:00 Authoring application: LaTeX with hyperref package (via PDFlib PLOP 2.0.0p6 (SunOS)/Acrobat Distiller 5.0.5 (Windows))
MD5: 9a4dad7b8937ae339eaa864536e412ee SHA-1: a5f76c08adb363db9b07e714faac912c77ea9d61 SHA-256: 0f6e88fdefe760e28b397330a56623bb5cf7c84a56a7580a4ba91e58c5f7ea51
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The document body itself is heavily obfuscated, but the presence of numerous links to a single domain suggests a coordinated effort to distribute content or manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-customary-law-of-rembau.pdf
    • http://www.gorillawalker.com/three-dimensions-of-vocabulary-growth-2nd-ed-r450p.pdf
    • http://www.gorillawalker.com/absolute-beginners-keyboard-book-2.pdf
    • http://www.gorillawalker.com/recovering-from-autism-our-family-s-journey-of-hope-and.pdf
    • http://www.gorillawalker.com/iroquoian-archaeology-and-analytic-scale.pdf
    • http://www.gorillawalker.com/summer-at-tiffany.pdf
    • http://www.gorillawalker.com/mazeppa-symphonic-poem-no-6-s-100-study-score.pdf
    • http://www.gorillawalker.com/three-uneasy-pieces.pdf
    • http://www.gorillawalker.com/ancient-egyptians-facts-of-life.pdf
    • http://www.gorillawalker.com/old-trucks-wall-calendar-2016-vehicle-calendar-antique-calendar-poster.pdf
    • http://www.gorillawalker.com/hiking-climbing-exploring-western-utah-s-jack-watson-s-ibex.pdf
    • http://www.gorillawalker.com/by-allen-j-wilcox-fertility-and-pregnancy-an-epidemiologic-perspective.pdf
    • http://www.gorillawalker.com/bpr-benchmarking-tqm-and-six-sigma-management.pdf
    • http://www.gorillawalker.com/center-church-doing-balanced-gospel-centered-ministry-in-your-city.pdf
    • http://www.gorillawalker.com/white-ironstone-china-plate-identification-guide-1840-1890-a-schiffer.pdf
    • http://www.gorillawalker.com/akira-tobu-12-japanese-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/let-it-rip-the-ultimate-guide-to-snowboarding.pdf
    • http://www.gorillawalker.com/steampunk-submarine-2-lesbian-m.pdf
    • http://www.gorillawalker.com/sammelband-schwule-sexsklaven-und-geile-retter-zehn-erotische-gay-geschichten.pdf
    • http://www.gorillawalker.com/visual-fitness-7-minutes-to-better-eyesight-and-beyond.pdf
    • http://www.gorillawalker.com/haunting-blackie-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/other-sheep-i-have-the-autobiography-of-father-paul-m.pdf
    • http://www.gorillawalker.com/understand-your-brain-get-more-done-the-adhd-executive-functions.pdf
    • http://www.gorillawalker.com/managed-care-a-nursing-perspective.pdf
    • http://www.gorillawalker.com/jane-s-avionics-2007-2008-jane-s-flight-avionics.pdf
    • http://www.gorillawalker.com/wish-her-safe-at-home-new-york-review-books.pdf
    • http://www.gorillawalker.com/the-jordan-valley-and-petra-volume-2.pdf
    • http://www.gorillawalker.com/the-luxury-of-skepticism-politics-philosophy-and-dialogue-in-the.pdf
    • http://www.gorillawalker.com/overcoming-fake-talk-how-to-hold-real-conversations-that-create.pdf
    • http://www.gorillawalker.com/nonlinear-structural-analysis-for-engineers.pdf
    • http://www.gorillawalker.com/ascending-the-boneyard.pdf
    • http://www.gorillawalker.com/mergers-and-acquisitions-in-the-energy-sector-the-impact-of.pdf
    • http://www.gorillawalker.com/consequences-of-party-reform.pdf
    • http://www.gorillawalker.com/cmm-beginners-understanding-understanding-the-basics-volume-1.pdf
    • http://www.gorillawalker.com/the-opposite-of-spoiled-raising-kids-who-are-grounded-generous.pdf
    • http://www.gorillawalker.com/compulsion-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/how-to-draw-insects-facsimile-reprint.pdf
    • http://www.gorillawalker.com/working-words-in-spelling-revised-edition-d.pdf
    • http://www.gorillawalker.com/voices-found-leader-s-guide.pdf
    • http://www.gorillawalker.com/epilepsy-practical-and-easy-to-follow-advice-your-child.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.