Malicious PDF — malware analysis report

Static analysis result for SHA-256 11d1d3ffbd145818…

MALICIOUS

PDF

36.1 KB Created: 2019-12-09 21:56:37 +03:00 Authoring application: PDF CoDe 2015.5473 (c) 2002-2015 European Commission
MD5: 4b42e74453ac0706eee20757e77d6e7a SHA-1: 8fa762b523c924bbc085ffc40e31f74340fe46eb SHA-256: 11d1d3ffbd1458186f5668afc31e5819176ff161ec726ce8c327b57bff99225e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was flagged by a critical heuristic for containing a large number of external PDF links, suggesting a link farm or SEO poisoning attempt. The ML classifier also indicated a high probability of maliciousness. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of numerous links to other PDFs on the same domain points to a content-driven attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8218

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/toro-bravo-stories-recipes-no-bull.pdf
    • http://www.gorillawalker.com/enemy-at-the-gates-the-battle-for-stalingrad.pdf
    • http://www.gorillawalker.com/reflection-kindle-edition.pdf
    • http://www.gorillawalker.com/annual-report-of-the-state-board-of-tax-commissioners-of.pdf
    • http://www.gorillawalker.com/lincoln-and-booth-more-light-on-the-conspiracy.pdf
    • http://www.gorillawalker.com/all-the-leader-you-can-be-the-science-of-achieving.pdf
    • http://www.gorillawalker.com/storybook-art-hands-on-art-for-children-in-the-styles.pdf
    • http://www.gorillawalker.com/kaplan-ged-complete-self-study-guide-for-the-ged-tests.pdf
    • http://www.gorillawalker.com/the-literary-importer-of-le-havre-maison-jobin-imports-coffee.pdf
    • http://www.gorillawalker.com/forming-copper-2nd-edition-a-beginner-s-guide-kindle-edition.pdf
    • http://www.gorillawalker.com/basic-algebra-ii-bk-2.pdf
    • http://www.gorillawalker.com/nfl-rush-zone-season-of-the-guardians-1-philadelphia-eagles.pdf
    • http://www.gorillawalker.com/children-chinese-medicine-treatment-of-femoral-head-necrosis-paperback-chinese.pdf
    • http://www.gorillawalker.com/20-20-diet-recipes-delicious-fat-shredding-20-20-diet.pdf
    • http://www.gorillawalker.com/darwin-s-armada-four-voyages-and-the-battle-for-the.pdf
    • http://www.gorillawalker.com/bookkeeping-for-dummies-for-dummies-series.pdf
    • http://www.gorillawalker.com/bioinorganic-chemistry-a-survey.pdf
    • http://www.gorillawalker.com/el-programa-de-eficacia-personal-c-mo-conseguir-organizar-su.pdf
    • http://www.gorillawalker.com/frankie-s-magic-soccer-ball-4-frankie-vs-the-mummy.pdf
    • http://www.gorillawalker.com/gay-tijuana-male-escort-straight-first-time-gay-erotica-interracial.pdf
    • http://www.gorillawalker.com/the-composition-of-old-english-poetry-review-an-article-from.pdf
    • http://www.gorillawalker.com/la-caridad-pastoral-en-el-derecho-penal-can-nicos-con.pdf
    • http://www.gorillawalker.com/frieden-durch-kommunikation-das-system-genscher-und-die-entspannungspolitik-im.pdf
    • http://www.gorillawalker.com/the-value-of-the-particular-lessons-from-judaism-and-the.pdf
    • http://www.gorillawalker.com/fire-dance.pdf
    • http://www.gorillawalker.com/exploding-the-myth-about-craps.pdf
    • http://www.gorillawalker.com/british-secret-projects-4-hypersonics-ramjets-and-missiles.pdf
    • http://www.gorillawalker.com/the-best-ever-book-of-liverpool-jokes-lots-and-lots.pdf
    • http://www.gorillawalker.com/my-exchange-student.pdf
    • http://www.gorillawalker.com/the-conquest-the-story-of-a-negro-pioneer.pdf
    • http://www.gorillawalker.com/write-on-course-a-handbook-for-writing-thinking-and-learning.pdf
    • http://www.gorillawalker.com/annie-sloan-s-decorative-wood-finishes-a-step-by-step.pdf
    • http://www.gorillawalker.com/100-questions-answers-about-colorectal-cancer-arabic-edition.pdf
    • http://www.gorillawalker.com/the-foundation-engineering-handbook-second-edition.pdf
    • http://www.gorillawalker.com/pun-glish-a-dictionary-of-midwestern-puns.pdf
    • http://www.gorillawalker.com/fodor-s-costa-rica-2006-fodor-s-gold-guides.pdf
    • http://www.gorillawalker.com/nordic-heroes-in-the-market-and-a-wholesale-arrangement.pdf
    • http://www.gorillawalker.com/true-morality-and-its-counterfeits-a-critical-analysis-of-existentialist.pdf
    • http://www.gorillawalker.com/integration-of-ferroelectric-and-piezoelectric-thin-films-concepts-and-applications.pdf
    • http://www.gorillawalker.com/the-yugoslav-auschwitz-and-the-vatican.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.