Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bbb33d6a68e29f8…

MALICIOUS

PDF

40.8 KB Created: 2019-04-30 15:57:29 +03:00 Authoring application: Adobe Acrobat 6.02 (via Adobe Acrobat 6.02 Paper Capture Plug-in)
MD5: 3aa6b04a589c8acbb5a5484e70caf8ac SHA-1: 8259d4fa1bbb18db7f2332be2be21e2be630388d SHA-256: 1bbb33d6a68e29f836ed0fc64b90b38ef0628cb80d599f6e95ca9a8154c35a9d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a critical heuristic for containing a mass external PDF link farm, with 32 links found. The ML classifier also strongly indicated maliciousness. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a coordinated effort to distribute content or potentially malicious files under the guise of legitimate-looking documents. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/earth-ethics-environmental-ethics-animal-rights-and-practical-applications.pdf
    • http://www.gorillawalker.com/scion-gods-of-persia.pdf
    • http://www.gorillawalker.com/an-introduction-to-general-virology.pdf
    • http://www.gorillawalker.com/science-in-soccer-translating-theory-into-practice.pdf
    • http://www.gorillawalker.com/body-an-amazing-tour-of-human-anatomy.pdf
    • http://www.gorillawalker.com/it-is-finished-it-took-one-man-one-day-seven.pdf
    • http://www.gorillawalker.com/book-of-shadows-sweep-no-1.pdf
    • http://www.gorillawalker.com/new-york-allie-s-war-kindle-edition.pdf
    • http://www.gorillawalker.com/for-keeps-meaningful-patchwork-for-every-day-living.pdf
    • http://www.gorillawalker.com/mexico-aztec-spanish-and-republican-a-historical-geographical-political-statistical.pdf
    • http://www.gorillawalker.com/queen-of-clubs-crystal-kindle-edition.pdf
    • http://www.gorillawalker.com/telecourse-study-guide-for-seeds-backman-s-horizons-exploring-the.pdf
    • http://www.gorillawalker.com/remote-office-not-required.pdf
    • http://www.gorillawalker.com/the-only-one-who-knows.pdf
    • http://www.gorillawalker.com/becoming-qualitative-researchers-an-introduction-3rd-edition.pdf
    • http://www.gorillawalker.com/the-daimones-trilogy-omnibus-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/life-in-old-japan-coloring-book-dover-pictorial-archive-series.pdf
    • http://www.gorillawalker.com/the-texas-panhandle-frontier-the-m-k-brown-range-life.pdf
    • http://www.gorillawalker.com/cutting-rhythms-shaping-the-film-edit-digital.pdf
    • http://www.gorillawalker.com/practice-makes-perfect-mastering-vocabulary-practice-makes-perfect-series.pdf
    • http://www.gorillawalker.com/hellzapoppin-clovenhoof-book-4.pdf
    • http://www.gorillawalker.com/requiem-for-the-sudan-war-drought-and-disaster-relief-on.pdf
    • http://www.gorillawalker.com/sextus-empiricus-against-the-physicists-against-the-ethicists-loeb-classical.pdf
    • http://www.gorillawalker.com/woodworking-projects-1-60-easy-to-make-projects-from-hands.pdf
    • http://www.gorillawalker.com/the-skinny-carbs-diet-eat-pasta-potatoes-and-more-use.pdf
    • http://www.gorillawalker.com/painting-the-impressionist-still-life-with-margaret-aycock.pdf
    • http://www.gorillawalker.com/isyllabus-for-school-workbook-1-a-resource-for-islamic-studies.pdf
    • http://www.gorillawalker.com/small-animal-practice-clinical-hematology-1981-the-veterinary-clinics-of.pdf
    • http://www.gorillawalker.com/iran-middle-east-region-in-transition.pdf
    • http://www.gorillawalker.com/the-biology-of-mangroves-and-seagrasses-biology-of-habitats.pdf
    • http://www.gorillawalker.com/priapus.pdf
    • http://www.gorillawalker.com/the-catalog-of-catalogs-iv-the-complete-mail-order-directory.pdf
    • http://www.gorillawalker.com/getting-a-big-data-job-for-dummies.pdf
    • http://www.gorillawalker.com/die-muse-von-paris-bsb-romanbiografie-ein-frauenschicksal-german-edition.pdf
    • http://www.gorillawalker.com/weather-and-man-by-hans-h-neuberger-and-f-briscoe.pdf
    • http://www.gorillawalker.com/her-lion-protector-the-protectors-3-siren-publishing-allure.pdf
    • http://www.gorillawalker.com/standing-in-the-sun.pdf
    • http://www.gorillawalker.com/living-in-london-a-practical-guide.pdf
    • http://www.gorillawalker.com/texas-neighbors-the-key-the-promise-the-neighbor-heartsong-novella.pdf
    • http://www.gorillawalker.com/je-vais-me-sauver-the-runaway-bunny-french-edition.pdf
    • http://www.gorillawalker.com/mexico-aztec-spanish
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.