Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a66b965f98f8528…

MALICIOUS

PDF

43.1 KB Created: 2018-11-26 08:23:35 +03:00 Authoring application: Word (via Mac OS X 10.7.5 Quartz PDFContext)
MD5: 1718a718498b21c54415e65f47a66991 SHA-1: 428e0776ec31424f654a9c41ca4b3d4fa24b1a81 SHA-256: 1a66b965f98f8528caa4fd0e97c533b8a36c9cf2657b8048f1e8396820891763
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The document body is heavily obfuscated and does not provide clear textual lures, but the sheer volume of links suggests a tactic to drive traffic or distribute further content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/strategies-for-reading-assessment-and-instruction-helping-every-child-succeed.pdf
    • http://www.gorillawalker.com/guatemala-land-of-the-mayas.pdf
    • http://www.gorillawalker.com/sunday-morning-blend-volume-2-25-solo-keyboard-medleys-for.pdf
    • http://www.gorillawalker.com/revelation-the-triumph-of-god-lifeguide-bible-studies.pdf
    • http://www.gorillawalker.com/hell-gig-enlightening-the-road-comic.pdf
    • http://www.gorillawalker.com/massage-therapy-review-passing-the-ncetmb-and-ncetm-w-updated.pdf
    • http://www.gorillawalker.com/2007-2008-solar-energy-complete-guide-to-solar-power-and.pdf
    • http://www.gorillawalker.com/la-segunda-venida-de-cristo-vol-1-the-second-coming.pdf
    • http://www.gorillawalker.com/paradigms-in-computing-making-machines-and-models-for-design-agency.pdf
    • http://www.gorillawalker.com/jets-de-combate-de-la-infanteria-de-marina-de-ee.pdf
    • http://www.gorillawalker.com/ieee-std-142-1982-ieee-recommended-practice-for-grounding-of.pdf
    • http://www.gorillawalker.com/taste-of-eritrea-recipes-from-one-of-east-africa-s.pdf
    • http://www.gorillawalker.com/insiders-guide-to-olympic-peninsula-insiders-guide-series.pdf
    • http://www.gorillawalker.com/aerobatics-superwheels-thrill-sports.pdf
    • http://www.gorillawalker.com/usa-and-international-mathematical-olympiads-2005-examples-pictures-proofs-problem.pdf
    • http://www.gorillawalker.com/software-assessment-reliability-safety-testability-new-dimensions-in-engineering-series.pdf
    • http://www.gorillawalker.com/aircraft-maintenance-and-repair.pdf
    • http://www.gorillawalker.com/reflection-mazes-dover-children-s-activity-books.pdf
    • http://www.gorillawalker.com/national-geographic-destination-map-rome-destined-to-be-the-best.pdf
    • http://www.gorillawalker.com/bible-book-of-james-kindle-edition.pdf
    • http://www.gorillawalker.com/to-the-digital-age-research-labs-start-up-companies-and.pdf
    • http://www.gorillawalker.com/android-43-paradise-awakened-volume-1.pdf
    • http://www.gorillawalker.com/maya-ruins-in-central-america-in-color-tikal-copan-and.pdf
    • http://www.gorillawalker.com/teach-yourself-to-play-blues-harmonica.pdf
    • http://www.gorillawalker.com/life-s-little-destruction-book-boorish-insensitive-and-socially-obnoxious.pdf
    • http://www.gorillawalker.com/bach-j-s-12-chorales-for-4-trombones.pdf
    • http://www.gorillawalker.com/six-studies-for-the-pedal-piano-op-56.pdf
    • http://www.gorillawalker.com/mini-enciclopedia-aperturas-abiertas-para-el-jugador-de-club-spanish.pdf
    • http://www.gorillawalker.com/poultry-science-4th-edition.pdf
    • http://www.gorillawalker.com/the-betty-crocker-recipe-card-library.pdf
    • http://www.gorillawalker.com/bioreaction-engineering-principles.pdf
    • http://www.gorillawalker.com/an-introductory-guide-to-post-structuralism-and-postmodernism.pdf
    • http://www.gorillawalker.com/yearbook-of-morphology-2004.pdf
    • http://www.gorillawalker.com/appalachian-whitewater-the-central-mountains.pdf
    • http://www.gorillawalker.com/bliss-a-novel.pdf
    • http://www.gorillawalker.com/vida-blue-a-life.pdf
    • http://www.gorillawalker.com/movie-instrumental-solos-trumpet-level-2-3-bk-cd.pdf
    • http://www.gorillawalker.com/computational-financial-mathematics-using-mathematica-optimal-trading-in-stocks-and.pdf
    • http://www.gorillawalker.com/libro-de-oraciones-para-los-12-pasos-the-12-step.pdf
    • http://www.gorillawalker.com/weight-watchers-magazine-september-1998-volume-31-no-5-diet.pdf
    • http://www.gori
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.