Malicious PDF — malware analysis report

Static analysis result for SHA-256 214c9e8303b03190…

MALICIOUS

PDF

45.8 KB Created: 2019-04-11 16:14:25 +03:00 Authoring application: PScript5.dll Version 5.2.2 (via Acrobat Distiller 7.0 (Windows))
MD5: 2f08512e89fcf781d8840b5536bb9e87 SHA-1: 60e5bf2140cf6f999de3705a3a4be62748bbc30c SHA-256: 214c9e8303b031909f96f2c976d52ae05dfdbd8af2ef442ebe671ceeccbf155b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm, likely intended to manipulate search engine results or redirect users to potentially malicious content hosted on the linked domains. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/blessed-with-evil-a-story-of-the-hell-146-s.pdf
    • http://www.gorillawalker.com/from-conflict-to-cooperation-succeed-with-rocco-s-4-r.pdf
    • http://www.gorillawalker.com/low-and-high-style-in-italian-renaissance-art-garland-studies.pdf
    • http://www.gorillawalker.com/oxford-picture-dictionary-english-vietnamese-bilingual-dictionary-for-vietnamese-speaking.pdf
    • http://www.gorillawalker.com/supporting-windows-7.pdf
    • http://www.gorillawalker.com/rhetorical-grammar-grammatical-choices-rhetorical-effects-3rd-edition.pdf
    • http://www.gorillawalker.com/broadcast-indecency-f-c-c-regulation-and-the-first-amendment.pdf
    • http://www.gorillawalker.com/trumpet-solos-for-worship-volume-2-arranged-with-keyboard-accompaniment.pdf
    • http://www.gorillawalker.com/a-flora-of-sonoma-county.pdf
    • http://www.gorillawalker.com/wow-worship-2014-songbook-green.pdf
    • http://www.gorillawalker.com/wanderungen-durch-die-mittel-amerikanischen-freistaaten-nicaragua-honduras-und-san.pdf
    • http://www.gorillawalker.com/a-history-of-theatre-in-africa.pdf
    • http://www.gorillawalker.com/a-treatise-on-the-theory-and-management-of-ulcers-with.pdf
    • http://www.gorillawalker.com/holy-gift-the-true-meaning-of-gold-frankincense-and-myrrh.pdf
    • http://www.gorillawalker.com/a-christmas-tree-for-pyn.pdf
    • http://www.gorillawalker.com/bond-portfolio-management.pdf
    • http://www.gorillawalker.com/the-great-ones-volume-iv-v-4.pdf
    • http://www.gorillawalker.com/on-the-shores-of-politics-radical-thinkers.pdf
    • http://www.gorillawalker.com/earth-s-natural-resources.pdf
    • http://www.gorillawalker.com/how-to-start-a-home-based-online-retail-business-home.pdf
    • http://www.gorillawalker.com/holt-math-state-test-prep-workbook-grade-10-algebra-1.pdf
    • http://www.gorillawalker.com/what-to-drink-non-alcoholic-drinks-and-cocktails-served-during.pdf
    • http://www.gorillawalker.com/master-basic-plumbing-and-central-heating-teach-yourself.pdf
    • http://www.gorillawalker.com/the-poison-tree-selected-writings-of-rumphius-on-the-natural.pdf
    • http://www.gorillawalker.com/transport-processes-and-separation-process-principles-includes-unit-operations.pdf
    • http://www.gorillawalker.com/die-scheidungspapiere-roman-german-edition.pdf
    • http://www.gorillawalker.com/entropy-analysis-an-introduction-to-chemical-thermodynamics.pdf
    • http://www.gorillawalker.com/turkey-a-world-problem-of-to-day.pdf
    • http://www.gorillawalker.com/under-this-roof-the-white-house-and-the-presidency-21.pdf
    • http://www.gorillawalker.com/walter-benjamin-and-bertolt-brecht-the-story-of-a-friendship.pdf
    • http://www.gorillawalker.com/somewhere-from-west-side-story-sheet-music.pdf
    • http://www.gorillawalker.com/peds-rehab-notes-evaluation-and-intervention-pocket-guide-davis-s.pdf
    • http://www.gorillawalker.com/chymoi-kai-smoothies-smoothies.pdf
    • http://www.gorillawalker.com/string-builder-complete-pack-for-cello-3-book-set-includes.pdf
    • http://www.gorillawalker.com/the-inquest-hardscrabble-books-fiction-of-new-england.pdf
    • http://www.gorillawalker.com/guetteurs-des-saisons-french-edition.pdf
    • http://www.gorillawalker.com/rankin-s-heidilicious.pdf
    • http://www.gorillawalker.com/low-power-digital-cmos-design.pdf
    • http://www.gorillawalker.com/the-power-of-the-dharma-an-introduction-to-hinduism-and.pdf
    • http://www.gorillawalker.com/overview-of-international-cisg-sales-law-basic-contract-law-according.pdf
    • http://www.goril
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.