Malicious PDF — malware analysis report

Static analysis result for SHA-256 2293a60cb024eab2…

MALICIOUS

PDF

45.6 KB Created: 2018-11-30 20:34:14 +03:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.17)
MD5: cabfbf4db8fbfcc7b6ab118a9bf626c1 SHA-1: 8672398517c0f52fa8db134481e0aa7b15b6df58 SHA-256: 2293a60cb024eab2e85eccfac7e1bc80dcd515b5ff946e88a1bd6d6205a63abc
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external documents, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests the document's primary purpose is to act as a link farm, potentially for SEO manipulation or to distribute malicious links. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8974

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/analysis-of-categorical-data-with-r-chapman-hall-crc-texts.pdf
    • http://www.gorillawalker.com/the-sociological-tradition.pdf
    • http://www.gorillawalker.com/the-buildings-of-main-street-a-guide-to-american-commercial.pdf
    • http://www.gorillawalker.com/hablando-nos-entendemos-los-dos-spanish-edition.pdf
    • http://www.gorillawalker.com/how-to-land-a-top-paying-biological-scientists-job-your.pdf
    • http://www.gorillawalker.com/bahia-salvador-focus-guide-footprint-focus.pdf
    • http://www.gorillawalker.com/a-time-of-fire.pdf
    • http://www.gorillawalker.com/sacramental-realism-a-general-theory-of-the-sacraments.pdf
    • http://www.gorillawalker.com/iec-60077-5-ed-1-0-b-2003-railway-applications.pdf
    • http://www.gorillawalker.com/competitiveness-in-international-food-markets.pdf
    • http://www.gorillawalker.com/a-guide-to-simulation.pdf
    • http://www.gorillawalker.com/mergers-acquisitions-and-buyouts-sample-acquisition-agreements-with-tax-and.pdf
    • http://www.gorillawalker.com/common-dental-treatment-management-shortcomings-and-prevention-paperback-chinese-edition.pdf
    • http://www.gorillawalker.com/how-to-pilot-a-submarine-the-second-world-war-manual.pdf
    • http://www.gorillawalker.com/chicken-recipes-top-10-chicken-dishes-recipes-top-recipes.pdf
    • http://www.gorillawalker.com/athletics-2002-the-international-track-field-annual.pdf
    • http://www.gorillawalker.com/looking-back-at-tyne-liners-1900-1962-classic-passenger-ships.pdf
    • http://www.gorillawalker.com/ib-matematicas-nivel-medio-libro-del-alumno-programa-del-diploma.pdf
    • http://www.gorillawalker.com/executive-power-how-executives-influence-people-and-organizations-jossey-bass.pdf
    • http://www.gorillawalker.com/outline-and-list-of-readings-for-the-course-in-the.pdf
    • http://www.gorillawalker.com/el-libro-de-urantia-revelando-los-misterios-de-dios-el.pdf
    • http://www.gorillawalker.com/atlas-of-human-glomerular-pathology-correlative-light-immunofluorescence-and-ultrastructural.pdf
    • http://www.gorillawalker.com/the-thirteen-problems-miss-marple-mysteries.pdf
    • http://www.gorillawalker.com/seal-team-bravo-black-ops-iv.pdf
    • http://www.gorillawalker.com/first-born-the-death-of-arnold-zeleznik.pdf
    • http://www.gorillawalker.com/a-treatise-on-the-measure-of-damages-or-an-inquiry.pdf
    • http://www.gorillawalker.com/chopin-mazurka-op-59-no-2-instantly-download-and-print.pdf
    • http://www.gorillawalker.com/nuevo-manual-de-meditaci-n-the-new-meditation-handbook-meditaciones.pdf
    • http://www.gorillawalker.com/power-quality-enhancement-using-custom-power-devices-power-electronics-and.pdf
    • http://www.gorillawalker.com/spear-of-the-nation-umkhonto-wesizwe-south-africa-146-s.pdf
    • http://www.gorillawalker.com/the-book-of-enoch-with-yahuah-s-name-restored-a.pdf
    • http://www.gorillawalker.com/really-big-cats-rookie-read-about-science.pdf
    • http://www.gorillawalker.com/ase-test-prep-t8-preventive-maintenance-delmar-learning-s-ase.pdf
    • http://www.gorillawalker.com/improving-training-effectiveness-in-work-organizations-applied-psychology-series.pdf
    • http://www.gorillawalker.com/ign-bleue-2736e-solignac-sur-loire-aqua3-ign-bleue.pdf
    • http://www.gorillawalker.com/gender-and-law-theory-doctrine-and-commentary.pdf
    • http://www.gorillawalker.com/wolfgang-amadeus-mozart-play-by-play-piano-concerto-no-20.pdf
    • http://www.gorillawalker.com/the-geology-of-sirt-basin-volume-volume-i.pdf
    • http://www.gorillawalker.com/embryology-of-the-theory-of-the-pig.pdf
    • http://www.gorillawalker.com/star-carr-life-in-britain-after-the-ice-age-achaeology.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.