Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f9423b36abaaa68…

MALICIOUS

PDF

43.5 KB Created: 2019-03-16 08:59:05 +03:00 Authoring application: FineReader (via -)
MD5: a360a919f274ef6a296a3216383873ec SHA-1: 1e260cc6bee2240ae1e4f599f44faaf921fa8340 SHA-256: 0f9423b36abaaa68435d280cf807fa1565b92bb944813f7957ff2db8112c10d1
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/security-over-receivables-an-international-handbook.pdf
    • http://www.gorillawalker.com/trial-handbook-for-wisconsin-lawyers-wisconsin-practice-library.pdf
    • http://www.gorillawalker.com/embroidery-from-india-and-pakistan-fabric-folios.pdf
    • http://www.gorillawalker.com/quality-control-and-production-of-biological-control-agents-theory-and.pdf
    • http://www.gorillawalker.com/from-the-listening-hills-stories-bantam-books-western.pdf
    • http://www.gorillawalker.com/alien-mate.pdf
    • http://www.gorillawalker.com/girl-after-dark-the-complete-series-a-new-adult-erotic.pdf
    • http://www.gorillawalker.com/amsterdam-for-less-compact-guide.pdf
    • http://www.gorillawalker.com/bmw-320i-manual-1975-1983-75-83-haynes-repair-manuals.pdf
    • http://www.gorillawalker.com/la-travers-e-lectrique-des-pyr-n-es-histoire-de.pdf
    • http://www.gorillawalker.com/managerial-accounting-managerial-accounting-portland-state-university-ba-213-edition.pdf
    • http://www.gorillawalker.com/the-octopus-tree-annie-kirk-mysteries.pdf
    • http://www.gorillawalker.com/the-eastern-alps-including-the-bavarian-highlands-tyrol-salzburg-upper.pdf
    • http://www.gorillawalker.com/hardboiled-and-high-heeled-the-woman-detective-in-popular-culture.pdf
    • http://www.gorillawalker.com/bernacchi-on-computer-law-a-guide-to-the-legal-and.pdf
    • http://www.gorillawalker.com/art-intro-with-insects-eggs-and-oils-chinese-edition.pdf
    • http://www.gorillawalker.com/mycenaean-greece-routledge-revivals.pdf
    • http://www.gorillawalker.com/bikers-lust-bbw-motorcycle-romance.pdf
    • http://www.gorillawalker.com/the-skeleton-and-muscles-exploring-the-human-body.pdf
    • http://www.gorillawalker.com/magic-school-bus-presents-the-human-body-a-nonfiction-companion.pdf
    • http://www.gorillawalker.com/chineser-galoppe-op-20-arrangement-for-small-orchestra-keyboard-conductor.pdf
    • http://www.gorillawalker.com/pomp-and-circumstance-easy-solo-sheet-music-for-flute-kindle.pdf
    • http://www.gorillawalker.com/a-death-in-the-family-a-euphemia-martins-murder-mystery.pdf
    • http://www.gorillawalker.com/power-systems-analysis-and-design.pdf
    • http://www.gorillawalker.com/desire-unlimited-the-cinema-of-pedro-almodo-var-critical-studies.pdf
    • http://www.gorillawalker.com/smolder-a-devil-chaser-s-mc-romance-kindle-edition.pdf
    • http://www.gorillawalker.com/test-better-teach-better-the-instructional-role-of-assessment.pdf
    • http://www.gorillawalker.com/52nd-international-congress-of-meat-science-and-technology-harnessing-and.pdf
    • http://www.gorillawalker.com/stolen-childhoods.pdf
    • http://www.gorillawalker.com/eden-it-s-an-endless-world-volume-13.pdf
    • http://www.gorillawalker.com/on-first-principles.pdf
    • http://www.gorillawalker.com/whistler-preparing-for-kreutzer-for-violin-published-by-rubank-publications.pdf
    • http://www.gorillawalker.com/christmas-carols-for-cello-easy-songs-in-first-position.pdf
    • http://www.gorillawalker.com/department-of-respiratory-disease-cases-resolve-chinese-edition.pdf
    • http://www.gorillawalker.com/how-to-prevent-and-treat-diabetes-with-natural-medicine.pdf
    • http://www.gorillawalker.com/memories-of-mass-repression-narrating-life-stories-in-the-aftermath.pdf
    • http://www.gorillawalker.com/futaba-kun-change-volume-7.pdf
    • http://www.gorillawalker.com/starshine-aurora-rising-book-one-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/the-candy-man.pdf
    • http://www.gorillawalker.com/wave-mechanics-applied-to-semiconductor-heterostructures-monographs-of-physics-les.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.