Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a51fec5227b5af7…

MALICIOUS

PDF

44.9 KB Created: 2018-11-21 22:13:47 +03:00 Authoring application: DocBook XSL Stylesheets with Apache FOP (via Apache FOP Version 2.1)
MD5: 79b8be9535e133bbf7d757b77b0794ac SHA-1: 3dde06fd7b14edc6d03fe20e862d18854e381e77 SHA-256: 1a51fec5227b5af7c7e24e7e9c7777373ee20b1d8e54aac70f19e38bdb9dafa6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier and contains a large number of external links, indicating a potential SEO manipulation or content distribution scheme. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a link farm or a method to distribute further malicious content. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7914

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/reported-knowledge-and-management-of-acute-low-back-pain-by.pdf
    • http://www.gorillawalker.com/disturbed.pdf
    • http://www.gorillawalker.com/the-mini-fast-diet-burn-fat-faster-than-ever-with.pdf
    • http://www.gorillawalker.com/the-canadian-brass-book-of-beginning-quintets-tuba-b-c.pdf
    • http://www.gorillawalker.com/a-viking-settler-everyday-life-of-series.pdf
    • http://www.gorillawalker.com/molecular-biology-of-the-cell-a-problems-approach.pdf
    • http://www.gorillawalker.com/a-passion-for-the-past-creative-teaching-of-u-s.pdf
    • http://www.gorillawalker.com/yamaha-service-repair-handbook-80-175cc-enduro-motocross-1968-1976.pdf
    • http://www.gorillawalker.com/bankrupting-physics-how-today-s-top-scientists-are-gambling-away.pdf
    • http://www.gorillawalker.com/outcomes-pre-intermediate-real-english-for-the-real-world-outcomes.pdf
    • http://www.gorillawalker.com/disabled-world-travels-safe-travel-made-easier-for-the-disabled.pdf
    • http://www.gorillawalker.com/swinburne-s-medievalism-a-study-in-victorian-love-poetry.pdf
    • http://www.gorillawalker.com/cybersecurity-and-cyberwar-what-everyone-needs-to-knowrg.pdf
    • http://www.gorillawalker.com/it-s-all-about-her.pdf
    • http://www.gorillawalker.com/light-and-easy-diabetes-cuisine-2-ed-delicious-recipes-for.pdf
    • http://www.gorillawalker.com/oeuvres-completes-de-moliere-la-princesse-d-elide-les-plaisirs.pdf
    • http://www.gorillawalker.com/gower-s-principles-of-modern-company-law.pdf
    • http://www.gorillawalker.com/plyometrics.pdf
    • http://www.gorillawalker.com/landscape-and-ideology-the-english-rustic-tradition-1740-1860.pdf
    • http://www.gorillawalker.com/faust-act-iv-duel-trio-tenor-baritone-bass-que-voulez.pdf
    • http://www.gorillawalker.com/das-rheingold-wwv-86a-scene-iv-erda-s-warning-weiche.pdf
    • http://www.gorillawalker.com/what-is-a-rainbow-a-just-ask-book.pdf
    • http://www.gorillawalker.com/the-seashore-noisy-book.pdf
    • http://www.gorillawalker.com/kai-me-rah-ray-der-a-dystopian-sci-fi-novella.pdf
    • http://www.gorillawalker.com/abc-of-epilepsy.pdf
    • http://www.gorillawalker.com/washington-irving-twayne-s-united-states-authors-series.pdf
    • http://www.gorillawalker.com/magician-s-arsenal-professional-tricks-of-the-trade.pdf
    • http://www.gorillawalker.com/dunn-and-haimann-s-healthcare-management.pdf
    • http://www.gorillawalker.com/from-here-to-there-a-father-and-son-roadtrip-adventure.pdf
    • http://www.gorillawalker.com/la-biblia-para-los-bebes-mas-historias-la-biblia-para.pdf
    • http://www.gorillawalker.com/the-mask-strikes-back.pdf
    • http://www.gorillawalker.com/assessing-business-excellence.pdf
    • http://www.gorillawalker.com/larry-coryell-s-power-jazz-guitar-extending-your-creative-reach.pdf
    • http://www.gorillawalker.com/deutsch-kurzgrammatik-german-edition.pdf
    • http://www.gorillawalker.com/88-songwriting-wrongs-and-how-to-right-them-concrete-ways.pdf
    • http://www.gorillawalker.com/provincial-inca-archaeological-and-ethnohistorical-assessment-of-the-impact-of.pdf
    • http://www.gorillawalker.com/my-first-london-whizzy-wheels-four-vehicle-shaped-board-books.pdf
    • http://www.gorillawalker.com/australia-on-15-20-a-day.pdf
    • http://www.gorillawalker.com/birthdays-holidays-and-celebrations.pdf
    • http://www.gorillawalker.com/alzheimer-s-disease-a-forgotten-life-watts-library.pdf
    • http://www.gorillawalker.com/a-passion-for
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.