Malicious PDF — malware analysis report

Static analysis result for SHA-256 15f03bc7d49290e7…

MALICIOUS

PDF

43.2 KB Created: 2019-04-08 09:01:00 +03:00 Authoring application: Adobe InDesign CS3 (5.0.3) (via Adobe PDF Library 8.0)
MD5: 5326c603e46f28299f1d13b824c51e22 SHA-1: 67a601832faf3b474d417946d01b49075000da55 SHA-256: 15f03bc7d49290e7cf49328ebbfeae53458e39d03b6725c7ffe284233d70d314
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be SEO manipulation or potentially distributing further malicious content through these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/500-acres-and-no-place-to-hide-more-confessions-of.pdf
    • http://www.gorillawalker.com/computational-geomechanics-theory-and-applications-of-transport-in-porous-media.pdf
    • http://www.gorillawalker.com/sextasy.pdf
    • http://www.gorillawalker.com/a-story-book-of-jesus-enid-byton-religious-stories.pdf
    • http://www.gorillawalker.com/but-i-deserve-this-chocolate-the-fifty-most-common-diet.pdf
    • http://www.gorillawalker.com/infj-21-career-choices-for-an-infj.pdf
    • http://www.gorillawalker.com/healing-scriptures-for-a-broken-heart-experience-emotional-healing-and.pdf
    • http://www.gorillawalker.com/best-deal-s-in-pattaya-thailand-shopping-volume-1.pdf
    • http://www.gorillawalker.com/mapa-geologico-de-chile-hoja-1-1-000-000-1982.pdf
    • http://www.gorillawalker.com/the-very-attractive-mrs-samantha.pdf
    • http://www.gorillawalker.com/sleeping-in-a-sack-camping-activities-for-kids-acitvities-for.pdf
    • http://www.gorillawalker.com/writing-effective-news-releases-how-to-get-free-publicity-for.pdf
    • http://www.gorillawalker.com/seaside-blessings-love-inspired.pdf
    • http://www.gorillawalker.com/el-ni-o-1997-1998-the-climate-event-of-the.pdf
    • http://www.gorillawalker.com/digital-product-and-product-data-management.pdf
    • http://www.gorillawalker.com/taking-his-big-delivery-unprotected-and-stretched-super-hung-short.pdf
    • http://www.gorillawalker.com/a-history-of-the-arabs-in-the-sudan-and-some.pdf
    • http://www.gorillawalker.com/versos-diversos-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/travel-and-talk-1885-93-95-my-hundred-thousand-miles.pdf
    • http://www.gorillawalker.com/princess-sonora-and-the-long-sleep-princess-tales.pdf
    • http://www.gorillawalker.com/sticky-beak.pdf
    • http://www.gorillawalker.com/the-sugar-detox-guide-kick-your-sugar-habit-for-good.pdf
    • http://www.gorillawalker.com/let-s-kanikapila-ten-steps-to-learn-ukulele-the-hawaiian.pdf
    • http://www.gorillawalker.com/color-atlas-of-ent-diagnosis.pdf
    • http://www.gorillawalker.com/new-world-order-the-rise-of-the-police-state-in.pdf
    • http://www.gorillawalker.com/insight-travel-maps-bulgaria-romania-moldova-macedonia-eastern-serbia.pdf
    • http://www.gorillawalker.com/jovenes-en-el-tercer-milenio-spanish-edition.pdf
    • http://www.gorillawalker.com/max-brooks-the-extinction-parade-volume-1-tp.pdf
    • http://www.gorillawalker.com/beggars-or-angels.pdf
    • http://www.gorillawalker.com/music-of-brazil.pdf
    • http://www.gorillawalker.com/getting-to-the-core-of-english-language-arts-grades-6.pdf
    • http://www.gorillawalker.com/the-illusion-of-self-the-ego-and-its-influence.pdf
    • http://www.gorillawalker.com/j-ai-l-impression-de-ne-vous-avoir-jamais-vu.pdf
    • http://www.gorillawalker.com/the-mystery-of-the-blue-train-a-hercule-poirot-mystery.pdf
    • http://www.gorillawalker.com/permission-marketing-abridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/the-black-moon-a-novel-of-cornwall-1794-1795-poldark.pdf
    • http://www.gorillawalker.com/guardian-angel-tarot-cards-a-78-card-deck-and-guidebook.pdf
    • http://www.gorillawalker.com/the-view-from-mount-calvary-24-portraits-of-the-cross.pdf
    • http://www.gorillawalker.com/a-confederation-of-valor-valor-novel.pdf
    • http://www.gorillawalker.com/seductive-poison-a-jonestown-survivor-s-story-of-life-and.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.