Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b8507253391ce98…

MALICIOUS

PDF

34.0 KB Created: 2019-10-29 08:45:56 +03:00 Authoring application: - (via ABBYY FineReader 9.0 Sprint) First seen: 2021-06-28
MD5: 130055dbf111a4095863ebb095d00be7 SHA-1: 8b4e7ce4bfb17c9d88e81e17b53178e6d2cd756a SHA-256: 1b8507253391ce98e07dc616cc68f3debf75f7eb9d3393e5b00b503d9fd2a992
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be SEO manipulation or potentially distributing further malicious content through these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/ethiopia-and-the-bible-schweich-lectures-on-biblical-archaeology.pdf In PDF document text
    • http://www.gorillawalker.com/garrahand-drumming.pdfIn PDF document text
    • http://www.gorillawalker.com/after-the-evil.pdfIn PDF document text
    • http://www.gorillawalker.com/why-noah-chose-the-dove.pdfIn PDF document text
    • http://www.gorillawalker.com/making-and-using-the-atom-bomb-history-firsthand.pdfIn PDF document text
    • http://www.gorillawalker.com/essays-on-the-iliad-selected-modern-criticism.pdfIn PDF document text
    • http://www.gorillawalker.com/knowledge-and-information-management-in-the-public-sector.pdfIn PDF document text
    • http://www.gorillawalker.com/henry-von-ofterdingen-a-romance-dover-thrift-editions.pdfIn PDF document text
    • http://www.gorillawalker.com/transboundary-damage-in-international-law-cambridge-studies-in-international-and.pdfIn PDF document text
    • http://www.gorillawalker.com/combinatory-analysis-volumes-i-and-ii-ams-chelsea-publishing-v.pdfIn PDF document text
    • http://www.gorillawalker.com/dash-yaoi.pdfIn PDF document text
    • http://www.gorillawalker.com/keyboard-duets-from-the-16th-to-the-20th-century-for.pdfIn PDF document text
    • http://www.gorillawalker.com/martin-luther-king-and-the-montgomery-story.pdfIn PDF document text
    • http://www.gorillawalker.com/hitchhiker-s-guide-to-the-galaxy-the-complete-radio-series.pdfIn PDF document text
    • http://www.gorillawalker.com/dynastische-politik-und-legitimationsstrategien-der-della-rovere-potenziale-und-grenzen.pdfIn PDF document text
    • http://www.gorillawalker.com/un-common-courtesy-how-to-behave-decently-no-matter-what.pdfIn PDF document text
    • http://www.gorillawalker.com/ddc-learning-microsoft-office-2007-softcover-deluxe-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/icpc-2-r-international-classification-of-primary-care-oxford-medical.pdfIn PDF document text
    • http://www.gorillawalker.com/rephrasing-heidegger-a-companion-to-being-and-time-philosophica.pdfIn PDF document text
    • http://www.gorillawalker.com/choccy-heaven-1st-bite-of-the-naughtiest-chocolate-recepies-simply.pdfIn PDF document text
    • http://www.gorillawalker.com/mcdougal-littell-middle-school-math-course-2.pdfIn PDF document text
    • http://www.gorillawalker.com/ford-taunus-p5-die-gro-e-wanne-oder-das-ende.pdfIn PDF document text
    • http://www.gorillawalker.com/fueled-obsession-the-complete-box-set.pdfIn PDF document text
    • http://www.gorillawalker.com/enigma-selected-poems.pdfIn PDF document text
    • http://www.gorillawalker.com/global-tourism-and-informal-labour-relations-the-small-scale-syndrome.pdfIn PDF document text
    • http://www.gorillawalker.com/the-fourth-of-july-story.pdfIn PDF document text
    • http://www.gorillawalker.com/weight-watchers-7-day-start-box-set-3-in-1.pdfIn PDF document text
    • http://www.gorillawalker.com/hal-leonard-john-bonham-a-thunder-of-drums-book.pdfIn PDF document text
    • http://www.gorillawalker.com/wines-and-spirits.pdfIn PDF document text
    • http://www.gorillawalker.com/el-poder-de-la-cabala-tecnologia-para-el-alma.pdfIn PDF document text
    • http://www.gorillawalker.com/silenced-international-journalists-expose-media-censorship.pdfIn PDF document text
    • http://www.gorillawalker.com/gathering-storm-the-last-days-book-1.pdfIn PDF document text
    • http://www.gorillawalker.com/performance-mastery.pdfIn PDF document text
    • http://www.gorillawalker.com/food-of-the-gods-the-search-for-the-original-tree.pdfIn PDF document text
    • http://www.gorillawalker.com/countdown-to-your-perfect-wedding-from-engagement-ring-to-honeymoon.pdfIn PDF document text
    • http://www.gorillawalker.com/fisica-cuantica-quantum-physics-ciencia-y-tecnica-science-and-technology.pdfIn PDF document text
    • http://www.gorillawalker.com/manual-practice-set-for-comprehensive-assurance-systems-tool-cast-3rd.pdfIn PDF document text
    • http://www.gorillawalker.com/avicenna-on-exercising-massaging-bathing-eating-drinking-sleeping-and-treating.pdfIn PDF document text
    • http://www.gorillawalker.com/fingal-s-cave-the-poems-of-ossian-and-celtic-christianity.pdfIn PDF document text
    • http://www.gorillawalker.com/mary-and-the-saints-calendar-2010.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.