Malicious PDF — malware analysis report

Static analysis result for SHA-256 22a9a3563a2d6de5…

MALICIOUS

PDF

43.3 KB Created: 2019-03-17 04:41:08 +03:00 Authoring application: Adobe InDesign CS3 (5.0.2) (via Adobe PDF Library 8.0)
MD5: 17a2cc5454c77f8879d5ec7d1007225e SHA-1: 6c709d76ae43a51f2ab85c1bc90305b71299834d SHA-256: 22a9a3563a2d6de5abf51ccf02c0d5c0d6b4d55109a5cee24cf0898e254aff1e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. It contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute further malicious content. The document body is heavily obfuscated, preventing a clear understanding of its direct user-facing purpose, but the link farm strongly suggests a malicious intent related to content distribution or redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/blacks-in-college-a-comparative-study-of-students-success-in.pdf
    • http://www.gorillawalker.com/francis-ponge-the-table-poetry-an-article-from-world-literature.pdf
    • http://www.gorillawalker.com/the-games-we-played-the-golden-age-of-board-table.pdf
    • http://www.gorillawalker.com/romansy-13-theory-and-practice-of-robots-and-manipulators-cism.pdf
    • http://www.gorillawalker.com/luna-s-children-stranger-worlds.pdf
    • http://www.gorillawalker.com/what-to-do-when-your-mom-or-dad-says-make.pdf
    • http://www.gorillawalker.com/charlton-heston-s-hollywood-50-years-in-american-film.pdf
    • http://www.gorillawalker.com/cp69132-progressive-beginner-singing.pdf
    • http://www.gorillawalker.com/geological-field-guide-to-neogene-sections-in-jamaica-west-indies.pdf
    • http://www.gorillawalker.com/yoga-therapy-theory-and-practice.pdf
    • http://www.gorillawalker.com/counselling-and-psychology-for-health-professionals-therapy-in-practice.pdf
    • http://www.gorillawalker.com/black-ball-2007-calendar-the-negro-baseball-leagues.pdf
    • http://www.gorillawalker.com/astronomical-almanac-for-the-year-2015-and-its-companion-the.pdf
    • http://www.gorillawalker.com/jacques-hadamard-a-universal-mathematician-history-of-mathematics.pdf
    • http://www.gorillawalker.com/new-horizons-a-guide-to-sexuality-after-spinal-cord-injury.pdf
    • http://www.gorillawalker.com/mightier-than-the-sword-powerful-writing-in-the-legal-profession.pdf
    • http://www.gorillawalker.com/go-wild-wildlife-designs-to-color.pdf
    • http://www.gorillawalker.com/instant-magento-performance-optimization-how-to.pdf
    • http://www.gorillawalker.com/aufhebung-eines-wettbewerbsverbots-ohne-ausdruckliche-regelung-in-gerichtlichem-vergleich-german.pdf
    • http://www.gorillawalker.com/ordinance-maintenance-binoculars-field-glasses-and-b-c-telescopes-of.pdf
    • http://www.gorillawalker.com/menage-maker-ffm-mmff.pdf
    • http://www.gorillawalker.com/rethinking-bakhtin-extensions-and-challenges-studies-in-russian-literature-and.pdf
    • http://www.gorillawalker.com/without-you-children-and-young-people-growing-up-with-loss.pdf
    • http://www.gorillawalker.com/scarecrow.pdf
    • http://www.gorillawalker.com/misbehaving-sea-breeze-book-6.pdf
    • http://www.gorillawalker.com/the-other-side-making-tracks.pdf
    • http://www.gorillawalker.com/preventing-child-sexual-abuse-sharing-the-responsibility-child-youth-and.pdf
    • http://www.gorillawalker.com/leptin-wise-diet-understanding-leptin-and-the-venus-factor-review.pdf
    • http://www.gorillawalker.com/twentieth-century-interpretations-of-crime-and-punishment-a-collection-of.pdf
    • http://www.gorillawalker.com/how-to-restore-your-datsun-z-car.pdf
    • http://www.gorillawalker.com/rotunda-and-dzienkowski-s-professional-responsibility-a-student-s-guide.pdf
    • http://www.gorillawalker.com/maxims-english-and-french-edition.pdf
    • http://www.gorillawalker.com/5-country-dances-k-609-full-score-qty-2-a1842.pdf
    • http://www.gorillawalker.com/clinical-supervision-a-handbook-for-practitioners.pdf
    • http://www.gorillawalker.com/alternative-dispute-resolution-in-a-nutshell.pdf
    • http://www.gorillawalker.com/introduction-to-geometry.pdf
    • http://www.gorillawalker.com/laudate-pueri-dominum-three-vesper-psalms-no-2-vocal-score.pdf
    • http://www.gorillawalker.com/trust-us-we-re-experts-how-industry-manipulates-science-and.pdf
    • http://www.gorillawalker.com/panama-city-panama-s-pacific-islands-col.pdf
    • http://www.gorillawalker.com/the-secret-language-of-money-how-to-make-smarter-financial.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.