Malicious PDF — malware analysis report

Static analysis result for SHA-256 24d9999787a2e703…

MALICIOUS

PDF

41.4 KB Created: 2018-12-14 20:35:04 +03:00 Authoring application: Adobe InDesign CS6 (Macintosh) (via Acrobat Distiller 10.1.12 (Macintosh))
MD5: 597771f708047f79c822fab68742ddc0 SHA-1: de7b21f87c9877508efab3a494e66f4b87b9c04e SHA-256: 24d9999787a2e703b2f1332ef094ad37d5df13c6bfd8d09bcfb3f087767edf51
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of embedded external URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The primary attack pattern appears to be a link farm, likely intended to manipulate search engine rankings or to serve as a distribution point for further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/eusebio-merlo-decimas-camperas-de-ayer-y-de-hoy-spanish.pdf
    • http://www.gorillawalker.com/the-rococo-room.pdf
    • http://www.gorillawalker.com/the-bald-headed-hermit-the-artichoke-an-erotic-thesaurus.pdf
    • http://www.gorillawalker.com/financial-management-barron-s-business-library-series.pdf
    • http://www.gorillawalker.com/the-quills-of-the-porcupine-asante-nationalism-in-an-emergent.pdf
    • http://www.gorillawalker.com/from-the-banks-of-the-tamar-stories-of-country-characters.pdf
    • http://www.gorillawalker.com/buddhism-after-patriarchy-a-feminist-history-analysis-and-reconstruction-of.pdf
    • http://www.gorillawalker.com/everyone-s-welcome.pdf
    • http://www.gorillawalker.com/calculus-of-a-single-variable-9th-nineth-edition-text-only.pdf
    • http://www.gorillawalker.com/the-senders.pdf
    • http://www.gorillawalker.com/nelson-international-mathematics-2nd-edition-student-book-3.pdf
    • http://www.gorillawalker.com/horse-in-the-house-animal-ark-series-26.pdf
    • http://www.gorillawalker.com/viaje-a-los-sentimientos-spanish-edition.pdf
    • http://www.gorillawalker.com/the-keys-to-writing-for-television-and-films.pdf
    • http://www.gorillawalker.com/eliminating-fratricide-from-attack-helicopter-fires-an-army-aviator-s.pdf
    • http://www.gorillawalker.com/the-history-and-activities-of-the-aztecs-hands-on-ancient.pdf
    • http://www.gorillawalker.com/the-z-mirot-kumzitz-songbook-paperback-common.pdf
    • http://www.gorillawalker.com/the-richard-strauss-companion.pdf
    • http://www.gorillawalker.com/psion-delta-psion-series-3.pdf
    • http://www.gorillawalker.com/the-agile-manager-s-guide-to-writing-to-get-action.pdf
    • http://www.gorillawalker.com/urolithiasis-medical-answers-to-400-questions-on-skin-and-hair.pdf
    • http://www.gorillawalker.com/fusion-style-wedding-photography.pdf
    • http://www.gorillawalker.com/something-of-myself-and-others.pdf
    • http://www.gorillawalker.com/gan-jue-di-ji-lu-shu-hai-fu-cha-wen.pdf
    • http://www.gorillawalker.com/precalculus-graphical-numerical-algebraic-8th-edition.pdf
    • http://www.gorillawalker.com/the-1980-u-s-olympic-boycott-a-history-perspectives-book.pdf
    • http://www.gorillawalker.com/geometric-measure-theory-and-real-analysis-publications-of-the-scuola.pdf
    • http://www.gorillawalker.com/hackers-toefl-listening-korean-edition.pdf
    • http://www.gorillawalker.com/the-100-best-astrophotography-targets-a-monthly-guide-for-ccd.pdf
    • http://www.gorillawalker.com/the-book-on-networks-everything-you-need-to-know-about.pdf
    • http://www.gorillawalker.com/nikki-giovanni-poet-of-the-people-african-american-biographies-enslow.pdf
    • http://www.gorillawalker.com/the-quaker-caf.pdf
    • http://www.gorillawalker.com/newswriting.pdf
    • http://www.gorillawalker.com/el-coraz-n-de-tram-rea-spanish-edition.pdf
    • http://www.gorillawalker.com/respiratory-physiology-basics-and-applications.pdf
    • http://www.gorillawalker.com/mommy-found-a-lump.pdf
    • http://www.gorillawalker.com/the-dutch-language-in-britain-1550-1702-a-social-history.pdf
    • http://www.gorillawalker.com/american-history-through-hollywood-film-from-the-revolution-to-the.pdf
    • http://www.gorillawalker.com/the-naked-emperor-darwinism-exposed.pdf
    • http://www.gorillawalker.com/the-pastures-of-heaven-mandarin-classic.pdf
    • http://www.gorillawalker.com/everyone-s-welcome
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.