Malicious PDF — malware analysis report

Static analysis result for SHA-256 10f16c732baf432e…

MALICIOUS

PDF

42.9 KB Created: 2018-12-07 18:28:23 +03:00 Authoring application: LaTeX with hyperref package (via xdvipdfmx)
MD5: aa55815c9038d230855e57b71c78be87 SHA-1: 39efaad017a2125491f9bb5e160bcf5c94a4ad55 SHA-256: 10f16c732baf432ec396ec6720894e431ed7d7ccf47fe3750fbb7961cb11b412
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily obfuscated and unreadable, the presence of 32 external PDF links suggests a link farm or redirection scheme. The ML classifier also flagged this PDF as malicious, supporting the suspicious nature of the link distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/travels-in-the-panjab-afghanistan-and-turkistan-to-balk-bokhara.pdf
    • http://www.gorillawalker.com/herbal-journal-herbs-healing-and-folkways-2011-engagement-calendar-engagement.pdf
    • http://www.gorillawalker.com/finding-your-dream-work-from-home-job-without-getting-scammed.pdf
    • http://www.gorillawalker.com/settlement-revolution-war.pdf
    • http://www.gorillawalker.com/comparing-constitutions.pdf
    • http://www.gorillawalker.com/children-in-the-bible-volume-1.pdf
    • http://www.gorillawalker.com/ricard-terre-obras-maestras.pdf
    • http://www.gorillawalker.com/clinical-nephrology-2015-the-clinical-medicine-series-book-24-kindle.pdf
    • http://www.gorillawalker.com/sacred-seed.pdf
    • http://www.gorillawalker.com/george-jeffreys-a-ministry-of-the-miraculous.pdf
    • http://www.gorillawalker.com/shakespeare-and-the-english-speaking-cinema-oxford-shakespeare-topics.pdf
    • http://www.gorillawalker.com/case-david-brown-1845c-uniloader-1995-after-operators-manual.pdf
    • http://www.gorillawalker.com/sister-sarah-s-cyprus-lucky-address-finders-kindle-edition.pdf
    • http://www.gorillawalker.com/hiking-and-backpacking-outdoor-adventures-series.pdf
    • http://www.gorillawalker.com/ultimate-flexibility-a-complete-guide-to-stretching-for-martial-arts.pdf
    • http://www.gorillawalker.com/michael-s-smith-elements-of-style.pdf
    • http://www.gorillawalker.com/the-psychology-of-early-childhood-a-study-of-mental-development.pdf
    • http://www.gorillawalker.com/el-navegante-de-los-suenos-spanish-edition.pdf
    • http://www.gorillawalker.com/stereoscopic-atlas-of-small-animal-surgery-thoracic-abdominal-and-soft.pdf
    • http://www.gorillawalker.com/principles-of-ecology-and-management.pdf
    • http://www.gorillawalker.com/jerusalem-great-cities-of-the-world.pdf
    • http://www.gorillawalker.com/saddle-fit-demystified-english-saddle-fitting-book.pdf
    • http://www.gorillawalker.com/bears-without-fear.pdf
    • http://www.gorillawalker.com/doing-business-2012-doing-business-in-a-more-transparent-world.pdf
    • http://www.gorillawalker.com/happy-daft-volume-ii.pdf
    • http://www.gorillawalker.com/mechanics-of-fracture-and-fatigue-an-introduction.pdf
    • http://www.gorillawalker.com/decorating-the-smart-approach-to-design-home-decorating.pdf
    • http://www.gorillawalker.com/optimization-methods-and-applications-applied-optimization.pdf
    • http://www.gorillawalker.com/portrait-painter-s-pocket-palette.pdf
    • http://www.gorillawalker.com/the-celebutantes-to-the-penthouse.pdf
    • http://www.gorillawalker.com/write-now-the-ultimate-grab-a-pen-get-the-words.pdf
    • http://www.gorillawalker.com/newton-in-90-minutes-1642-1727-scientists-in-90-minutes.pdf
    • http://www.gorillawalker.com/miracle-breakthrough-power-of-the-first-fruit.pdf
    • http://www.gorillawalker.com/antigua-guatemala-a-city-guide.pdf
    • http://www.gorillawalker.com/hal-leonard-rubank-concert-and-contest-collection-f-horn-book.pdf
    • http://www.gorillawalker.com/arab-media-globalization-and-emerging-media-industries.pdf
    • http://www.gorillawalker.com/the-complete-illustrated-encyclopedia-of-world-motorcycles.pdf
    • http://www.gorillawalker.com/exploration-and-processing-of-mineral-resources-selected-peer-reviewed-papers.pdf
    • http://www.gorillawalker.com/wake-of-vultures-the-shadow.pdf
    • http://www.gorillawalker.com/aviation-maintenance-alerts-sudoc-td-4-414.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.