Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d46d4576be8d629…

MALICIOUS

PDF

43.2 KB Created: 2018-12-11 20:44:28 +03:00 Authoring application: - (via GPL Ghostscript 8.70)
MD5: 7c2002429875086a76fa3076e3d5270d SHA-1: 86525de151d7636c7a1b861cb492eee03d021733 SHA-256: 1d46d4576be8d6296fdbf55c10ef5e9ac95ab4a0eded7d45cc1d4f0ccace0f60
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a link farm, potentially for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8859

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/tomorrow-girls-3-with-the-enemy.pdf
    • http://www.gorillawalker.com/maritime-economics-3e.pdf
    • http://www.gorillawalker.com/almost-anxious-is-my-or-my-loved-one-s-worry.pdf
    • http://www.gorillawalker.com/karagiozis-culture-and-comedy-in-greek-puppet-theater.pdf
    • http://www.gorillawalker.com/hell-looks-different-now-one-corpsman-s-journey-back-to.pdf
    • http://www.gorillawalker.com/minimally-invasive-endonasal-sinus-surgery-principles-techniques-results-complications-revision.pdf
    • http://www.gorillawalker.com/cristo-en-la-pascua-spanish-edition.pdf
    • http://www.gorillawalker.com/writing-power-2.pdf
    • http://www.gorillawalker.com/approaches-to-hinduism-world-religions-in-education.pdf
    • http://www.gorillawalker.com/mercedes-benz-300-1951-1962-schiffer-automotive-series.pdf
    • http://www.gorillawalker.com/crisis-tales-five-rules-for-coping-with-crises-in-business.pdf
    • http://www.gorillawalker.com/the-tennessee-bucket-list-100-ways-to-have-a-real.pdf
    • http://www.gorillawalker.com/the-mathematics-of-circuit-analysis.pdf
    • http://www.gorillawalker.com/adventures-in-tibet-including-the-diary-of-miss-annie-r.pdf
    • http://www.gorillawalker.com/pilates-basics-a-relaxing-way-to-energize-and-heal-from.pdf
    • http://www.gorillawalker.com/nature-speak-signs-omens-and-messages-in-nature.pdf
    • http://www.gorillawalker.com/words-of-love-friendship-wall-calendar-2016-art-calendar.pdf
    • http://www.gorillawalker.com/ac-dc-the-definitive-history.pdf
    • http://www.gorillawalker.com/animal-andrology-theories-and-applications.pdf
    • http://www.gorillawalker.com/athens-the-city-of-intellect-and-democracy-greek-guides.pdf
    • http://www.gorillawalker.com/ciencia-sin-seso-locura-doble-spanish-edition.pdf
    • http://www.gorillawalker.com/alphatales-letter-r-rosey-rabbit-s-radish-a-series-of.pdf
    • http://www.gorillawalker.com/children-at-risk-the-precarious-state-of-children-s-well.pdf
    • http://www.gorillawalker.com/minnesota-state-recreational-atlas-state-rec-atlas.pdf
    • http://www.gorillawalker.com/inhomogeneous-optical-waveguides-optical-physics-and-engineering.pdf
    • http://www.gorillawalker.com/les-pecheurs-de-perles-opera-vocal-score-text-in-french.pdf
    • http://www.gorillawalker.com/side-by-side-4-activity-workbook-4.pdf
    • http://www.gorillawalker.com/the-summer-s-end-progressive-rock-festival-the-first-ten.pdf
    • http://www.gorillawalker.com/indian-origins-and-the-book-of-mormon-religious-solutions-from.pdf
    • http://www.gorillawalker.com/homes-down-east-classic-maine-coastal-cottages-and-town-houses.pdf
    • http://www.gorillawalker.com/orson-cart-on-mars-orson-cart.pdf
    • http://www.gorillawalker.com/the-hub-s-metropolis-greater-boston-s-development-from-railroad.pdf
    • http://www.gorillawalker.com/issues-in-voluntary-and-non-profit-management.pdf
    • http://www.gorillawalker.com/making-classroom-assessment-work.pdf
    • http://www.gorillawalker.com/virgin-global-challenger-the-inside-story-of-richard-branson-and.pdf
    • http://www.gorillawalker.com/backcountry-adventures-arizona-new-hardcover-edition.pdf
    • http://www.gorillawalker.com/dark-cloud-thirty-fifth-in-the-series-of-jess-williams.pdf
    • http://www.gorillawalker.com/the-companion-guide-to-the-greek-islands.pdf
    • http://www.gorillawalker.com/erosive-tooth-wear-from-diagnosis-to-therapy-monographs-in-oral.pdf
    • http://www.gorillawalker.com/philippines-festivals-of-the-world.pdf
    • http://www.gorillawalker.com/minimally-invasive-en
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.