Malicious PDF — malware analysis report

Static analysis result for SHA-256 155829346b437f07…

MALICIOUS

PDF

42.9 KB Created: 2019-04-30 16:26:57 +03:00 Authoring application: Adobe InDesign CS5 (7.0.3) (via Adobe PDF Library 9.9)
MD5: fbee0c7ff1dfa5cb3561a20348584c66 SHA-1: ffec9f3bcc3ea8b2f0046cec8cc200759e3be094 SHA-256: 155829346b437f07ca8e96a8eced3680af730b23b6f67c31fff777e1766e0a03
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious. The document body is heavily obfuscated, but the presence of numerous links to a single domain suggests a coordinated effort to manipulate search engine results or distribute content from that domain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/iso-13215-2-1999-road-vehicles-reduction-of-misuse-risk.pdf
    • http://www.gorillawalker.com/cook-manson-s-tropical-diseases.pdf
    • http://www.gorillawalker.com/the-secrets-of-sir-richard-kenworthy-smythe-smith-quartet-book.pdf
    • http://www.gorillawalker.com/summer-islands-book-24-exciting-locations-kindle-edition.pdf
    • http://www.gorillawalker.com/st-barth-french-west-indies-a-concepts-book.pdf
    • http://www.gorillawalker.com/research-theatre-climate-change-and-the-ecocide-project-the-ecocide.pdf
    • http://www.gorillawalker.com/drawing-manga-people-and-poses.pdf
    • http://www.gorillawalker.com/an-introduction-to-ordinary-differential-equations-dover-books-on-mathematics.pdf
    • http://www.gorillawalker.com/job-and-the-god-of-babylon-theo-politics-the-covenant.pdf
    • http://www.gorillawalker.com/wondergenes-genetic-enhancement-and-the-future-of-society.pdf
    • http://www.gorillawalker.com/3-d-graphics-programming-with-opengl-book-and-disk.pdf
    • http://www.gorillawalker.com/phake-the-deadly-world-of-falsified-and-substandard-medicines.pdf
    • http://www.gorillawalker.com/bolivia-paraguay-map-by-nelles-nelles-map-english-french-italian.pdf
    • http://www.gorillawalker.com/the-past-love-money-and-much-more-phlippines-japan-relations.pdf
    • http://www.gorillawalker.com/disciples-are-made-not-born-helping-others-grow-to-maturity.pdf
    • http://www.gorillawalker.com/flavors-of-emilia-romagna-flavors-of-italy.pdf
    • http://www.gorillawalker.com/viva-galapagos-2014-viva-travel-guides-galapagos-islands-guidebook-kindle.pdf
    • http://www.gorillawalker.com/me-first-laugh-along-lessons.pdf
    • http://www.gorillawalker.com/the-wicked-whipping-society-of-merry-maids-passion-pain-and.pdf
    • http://www.gorillawalker.com/the-mummy-the-will-and-the-crypt-johnny-dixon-book.pdf
    • http://www.gorillawalker.com/the-bangladesh-sundarbans.pdf
    • http://www.gorillawalker.com/medical-claims-illustrated-handbook-2nd-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/shot-all-to-hell-jesse-james-the-northfield-raid-and.pdf
    • http://www.gorillawalker.com/cherry-point-can-do-and-harrier-ii-superbase-6.pdf
    • http://www.gorillawalker.com/learn-to-burn-drum-set-wall-chart.pdf
    • http://www.gorillawalker.com/parsi-english-novel.pdf
    • http://www.gorillawalker.com/the-black-prism-lightbringer-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/the-most-inspiring-prayers-prayers-that-will-change-your-life.pdf
    • http://www.gorillawalker.com/strength-for-life-the-fitness-plan-for-the-rest-of.pdf
    • http://www.gorillawalker.com/the-18th-division-in-the-great-war.pdf
    • http://www.gorillawalker.com/postmodernism-and-politics-theory-and-history-of-literature.pdf
    • http://www.gorillawalker.com/belgium-blastoff-readers-exploring-countries-level-5.pdf
    • http://www.gorillawalker.com/spares-the-bowling-cartoons-of-charles-m-schulz.pdf
    • http://www.gorillawalker.com/torn-wings-and-faux-pas-a-flashbook-of-style-a.pdf
    • http://www.gorillawalker.com/animal-senses-content-and-literacy-in-science-grade-4.pdf
    • http://www.gorillawalker.com/pediatric-airway-cry-stridor-and-cough.pdf
    • http://www.gorillawalker.com/figuraciones-mujeres-en-carmen-martin-gaite-revistas-feministas-y-hola.pdf
    • http://www.gorillawalker.com/griechische-dramen-orpheus-dipus-der-blinde-polyneikes-phaeton-sisyphos-german.pdf
    • http://www.gorillawalker.com/clinical-coach-for-nurse-practitioners-davis-s-clinical-coach.pdf
    • http://www.gorillawalker.com/russia-s-agony.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.