Malicious PDF — malware analysis report

Static analysis result for SHA-256 18f7a6b4399fdb2c…

MALICIOUS

PDF

45.8 KB Created: 2018-11-23 21:03:26 +03:00 Authoring application: Adobe PageMaker 6.52 (via Acrobat Distiller 3.01 for Windows)
MD5: 5e702b0de7b7e1f9405304fe9e5c802c SHA-1: 8851dd1ea5af74098b2af90df13f198ed632af0d SHA-256: 18f7a6b4399fdb2c9a61e4484523e132c13f34c4dac259ef8b6c4ae75fdcbcc0
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a link farm, likely for SEO manipulation or to serve as a landing page for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/a-future-for-archaeology-univ-col-london-inst-arch-pub.pdf
    • http://www.gorillawalker.com/happy-birthday-jesus-sing-a-story-handled-board-book-with.pdf
    • http://www.gorillawalker.com/by-r-e-sheriff-exploration-seismology-2nd-edition.pdf
    • http://www.gorillawalker.com/life-and-teachings-of-jesus-christ-basic-truth-about-god.pdf
    • http://www.gorillawalker.com/from-the-mary-higgins-clark-collection-book-lot-includes-i.pdf
    • http://www.gorillawalker.com/photographic-and-descriptive-musculoskeletal-atlas-of-chimpanzees-with-notes-on.pdf
    • http://www.gorillawalker.com/the-dark-deeps-the-hunchback-assignments-2.pdf
    • http://www.gorillawalker.com/in-the-trees-honey-bees.pdf
    • http://www.gorillawalker.com/la-verdadera-y-la-falsa-democracia-doctrina-constitucional-y-proyecto.pdf
    • http://www.gorillawalker.com/the-rise-of-false-messiahs-carpathia-s-evil-tricks-left.pdf
    • http://www.gorillawalker.com/families-we-choose-lesbians-gays-kinship.pdf
    • http://www.gorillawalker.com/laughter-the-best-medicine-a-laugh-out-loud-collection-of.pdf
    • http://www.gorillawalker.com/die-schlaf-und-traumzustande-der-menschlichen-seele-mit-besonderer-berucksichtigung.pdf
    • http://www.gorillawalker.com/bsava-vpis-guide-to-common-canine-and-feline-poisons-bsava.pdf
    • http://www.gorillawalker.com/cia-entrance-examination.pdf
    • http://www.gorillawalker.com/modern-dance-paperback.pdf
    • http://www.gorillawalker.com/alexander-s-story-dark-stranger-s-trilogy-book-2.pdf
    • http://www.gorillawalker.com/the-effectiveness-of-the-annual-report-as-a-communication-vehicle.pdf
    • http://www.gorillawalker.com/from-my-hands-to-yours-lessons-from-a-lifetime-of.pdf
    • http://www.gorillawalker.com/when-it-s-purim-very-first-board-books.pdf
    • http://www.gorillawalker.com/contact-mechanics-in-tribology-solid-mechanics-and-its-applications-volume.pdf
    • http://www.gorillawalker.com/unattended-radiation-sensor-systems-for-remote-applications-washington-dc-15.pdf
    • http://www.gorillawalker.com/the-immortal-coil-volume-1.pdf
    • http://www.gorillawalker.com/god-loves-haiti-a-novel.pdf
    • http://www.gorillawalker.com/acute-ischemic-stroke-pipeline-review-h2-2011-download-pdf-digital.pdf
    • http://www.gorillawalker.com/two-days-in-may.pdf
    • http://www.gorillawalker.com/dimensions-of-the-hospitality-industry-an-introduction-3rd-edition.pdf
    • http://www.gorillawalker.com/murder-of-crows-twisted-eventide-5.pdf
    • http://www.gorillawalker.com/communicating-with-the-world-of-beings-the-world-heritage-rock.pdf
    • http://www.gorillawalker.com/hinduism-and-christianity.pdf
    • http://www.gorillawalker.com/lean-sigma-methods-and-tools-for-service-organizations-the-story.pdf
    • http://www.gorillawalker.com/sweet-as-cane-salty-as-tears.pdf
    • http://www.gorillawalker.com/24-hours-with-24-lawyers-profiles-of-traditional-and-non.pdf
    • http://www.gorillawalker.com/where-do-monsters-live-learn-to-read-read-to-learn.pdf
    • http://www.gorillawalker.com/the-passing-of-inspector-morse-a-committed-atheist-s-journey.pdf
    • http://www.gorillawalker.com/children-who-remember-previous-lives-a-question-of-reincarnation.pdf
    • http://www.gorillawalker.com/cosmic-christ-archangel-metatron-kindle-edition.pdf
    • http://www.gorillawalker.com/one-word-that-will-change-your-life.pdf
    • http://www.gorillawalker.com/complete-nurse-s-guide-to-diabetes-care-childs-complete-nurse.pdf
    • http://www.gorillawalker.com/the-walking-dead-04-was-das-herz-begehrt-german-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.