Malicious PDF — malware analysis report

Static analysis result for SHA-256 2262a91cb72d8cc1…

MALICIOUS

PDF

48.2 KB Created: 2018-12-14 20:03:52 +03:00 Authoring application: DVIPSONE 2.2.4 http://www.YandY.com (via Acrobat Distiller 7.0.5 (Windows))
MD5: a52ebf2f08e85b05c97958ea6fb8399b SHA-1: ffc65e9471d61f9be0204b14de1d8f7bbf18e2e9 SHA-256: 2262a91cb72d8cc1671fe5eabbd2e7c78ffbaa9d0b39d572f4f5dfff003116c5
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or to distribute additional malicious content via the linked PDFs. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8550

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/start-something-that-matters-kindle-edition.pdf
    • http://www.gorillawalker.com/20th-century-trivia-quizbook.pdf
    • http://www.gorillawalker.com/many-heads-arms-and-eyes-origin-meaning-and-form-of.pdf
    • http://www.gorillawalker.com/astrology-rules-every-girl-s-dream-guide-to-her-stars.pdf
    • http://www.gorillawalker.com/introduction-to-geophysics-mantle-core-and-crust.pdf
    • http://www.gorillawalker.com/ersatz-in-the-confederacy-shortages-and-substitutes-on-the-southern.pdf
    • http://www.gorillawalker.com/quantitative-modeling-in-toxicology.pdf
    • http://www.gorillawalker.com/buttercup-bake-shop-cookbook.pdf
    • http://www.gorillawalker.com/falling-from-grace-into-grace-and-being-caught-by-the.pdf
    • http://www.gorillawalker.com/how-wind-turbines-work-discovering-how-things-work.pdf
    • http://www.gorillawalker.com/growing-older-growing-better-daily-meditations-for-celebrating-aging.pdf
    • http://www.gorillawalker.com/vision-for-life-ten-steps-to-natural-eyesight-improvement-by.pdf
    • http://www.gorillawalker.com/the-careerist-over-100-ways-to-get-ahead-at-work.pdf
    • http://www.gorillawalker.com/ethnographic-fieldwork-an-anthropological-reader.pdf
    • http://www.gorillawalker.com/lecture-notes-on-complex-analysis.pdf
    • http://www.gorillawalker.com/grafologia-graphology-spanish-edition.pdf
    • http://www.gorillawalker.com/60-hikes-within-60-miles-salt-lake-city-including-ogden.pdf
    • http://www.gorillawalker.com/why-did-the-dinosaurs-disappear-discovery-readers.pdf
    • http://www.gorillawalker.com/gymnasium-of-the-horse.pdf
    • http://www.gorillawalker.com/building-your-library-career-with-web-2-0-chandos-information.pdf
    • http://www.gorillawalker.com/hustling-is-not-stealing-stories-of-an-african-bar-girl.pdf
    • http://www.gorillawalker.com/working-solo-the-real-guide-to-freedom-financial-success-with.pdf
    • http://www.gorillawalker.com/the-fullness-of-earthly-bliss.pdf
    • http://www.gorillawalker.com/lightfoot-guide-to-slackpacking-the-camino-frances.pdf
    • http://www.gorillawalker.com/statistics-with-microsoft-excel-5th-edition.pdf
    • http://www.gorillawalker.com/seekers-of-the-horizon-sea-kayaking-voyages-from-around-the.pdf
    • http://www.gorillawalker.com/modus-operandi-the-card-magic-of-jack-carpenter.pdf
    • http://www.gorillawalker.com/the-threat-of-pandemic-influenza-are-we-ready-workshop-summary.pdf
    • http://www.gorillawalker.com/case-approach-to-counseling-and-psychotherapy-psy-641-introduction-to.pdf
    • http://www.gorillawalker.com/lee-kuan-yew-school-of-public-policy-building-a-global.pdf
    • http://www.gorillawalker.com/bach-bl-ten-und-kalifornische-bl-ten-von-a-z.pdf
    • http://www.gorillawalker.com/resting-in-him-i-need-to-slow-down-but-i.pdf
    • http://www.gorillawalker.com/symbolism-in-nineteenth-century-ballet-i-giselle-i-i-copp.pdf
    • http://www.gorillawalker.com/hacia-rutas-salvajes-spanish-edition.pdf
    • http://www.gorillawalker.com/romeo-and-juliet-in-full-colour-cartoon-illustrated-format-shakespeare.pdf
    • http://www.gorillawalker.com/the-killing-room.pdf
    • http://www.gorillawalker.com/principles-of-helicopter-flight.pdf
    • http://www.gorillawalker.com/always-a-kicker.pdf
    • http://www.gorillawalker.com/functional-neuroimaging-of-visual-cognition-attention-and-performance-series.pdf
    • http://www.gorillawalker.com/screenplay-the-ultimate-step-by-step-tutorial-for-screenwriting-made.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://www.YandY.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.