Malicious PDF — malware analysis report

Static analysis result for SHA-256 153b469a35e1bbd0…

MALICIOUS

PDF

34.7 KB Created: 2020-01-17 04:01:34 +03:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 7.0.5 (Windows))
MD5: d9710cf8ade34a0007896d8330b8cb19 SHA-1: 353e4fb7b693f5965467227f01206635e1579e32 SHA-256: 153b469a35e1bbd0d6b87053893ae5679d9f165020b6c08d234e2096c3480d96
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a website hosting numerous PDF documents, potentially for SEO spam or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8315

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/lb-brief-with-tabs-4th-edition-aaron-little-brown-franchise.pdf
    • http://www.gorillawalker.com/marty-s-ultimate-workout.pdf
    • http://www.gorillawalker.com/lab-manual-physical-geology-9e-im.pdf
    • http://www.gorillawalker.com/life-in-spite-of-a-death-sentence-one-man-s.pdf
    • http://www.gorillawalker.com/tectonic-climatic-and-cryospheric-evolution-of-the-antarctic-peninsula-special.pdf
    • http://www.gorillawalker.com/the-scent-of-pine-a-novel.pdf
    • http://www.gorillawalker.com/moon-guadalajara-including-lake-chapala-moon-handbooks.pdf
    • http://www.gorillawalker.com/the-annals-of-l-buwei.pdf
    • http://www.gorillawalker.com/lake-tarpon-safety-book-the-essential-lake-safety-guide-for.pdf
    • http://www.gorillawalker.com/the-digital-hand-how-computers-changed-the-work-of-american.pdf
    • http://www.gorillawalker.com/tech-knowledge-level-3.pdf
    • http://www.gorillawalker.com/report-of-secretarial-visit-to-the-rhodesia-and-transvaal-districts.pdf
    • http://www.gorillawalker.com/equity-and-the-law-of-trusts-in-ireland-5e.pdf
    • http://www.gorillawalker.com/terth-willager-age-of-mythology-kindle-edition.pdf
    • http://www.gorillawalker.com/breaking-point-how-the-primary-care-crisis-endangers-the-lives.pdf
    • http://www.gorillawalker.com/the-otago-central-railway-a-tribute.pdf
    • http://www.gorillawalker.com/the-day-the-bully-cried.pdf
    • http://www.gorillawalker.com/demon-hunter.pdf
    • http://www.gorillawalker.com/magic-lantern-guides-nikon-n75-f75-a-lark-photography-book.pdf
    • http://www.gorillawalker.com/the-intelligent-enneagram.pdf
    • http://www.gorillawalker.com/the-simplex-blackjack-strategy.pdf
    • http://www.gorillawalker.com/secret-letters-amish-romance-short-story-clean-romance-short-story.pdf
    • http://www.gorillawalker.com/das-geniale-ged-chtnis-wie-das-gehirn-aus-der-vergangenheit.pdf
    • http://www.gorillawalker.com/raising-champions-a-parent-handbook-for-nurturing-gifted-children.pdf
    • http://www.gorillawalker.com/a-fatal-grace-a-chief-inspector-gamache-novel.pdf
    • http://www.gorillawalker.com/transformation-letting-god-change-you-from-the-inside-out-interactions.pdf
    • http://www.gorillawalker.com/frederick-douglass-abolitionist-editor-black-americans-of-achievement.pdf
    • http://www.gorillawalker.com/data-design-visualising-quantities-locations-connections.pdf
    • http://www.gorillawalker.com/nutrition-diet-therapy-4th-edition.pdf
    • http://www.gorillawalker.com/cooking-light-oops-209-solutions-for-everyday-kitchen-mistakes.pdf
    • http://www.gorillawalker.com/birding.pdf
    • http://www.gorillawalker.com/unix-and-linux-visual-quickstart-guide-5th-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/complete-theory-test-for-cars-and-motorcycles-punjabi-edition.pdf
    • http://www.gorillawalker.com/the-molecular-biology-of-baculoviruses-current-topics-in-microbiology-and.pdf
    • http://www.gorillawalker.com/a-field-guide-to-the-fungi-of-australia.pdf
    • http://www.gorillawalker.com/adobe-after-effects-cc-learn-by-video-2014-release.pdf
    • http://www.gorillawalker.com/influence-of-the-carnegie-ford-and-rockefeller-foundations-on-american.pdf
    • http://www.gorillawalker.com/key-guide-ghid-turistic-barcelona.pdf
    • http://www.gorillawalker.com/suicide-history-of-issues.pdf
    • http://www.gorillawalker.com/harold-e-stassen-the-life-and-perennial-candidacy-of-the.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.