Malicious PDF — malware analysis report

Static analysis result for SHA-256 25877f561e142a37…

MALICIOUS

PDF

42.6 KB Created: 2019-03-17 10:24:06 +03:00 Authoring application: - (via Foxit Phantom Printer Version 3.0.3.0804)
MD5: 1f73df37c59f314f3260dcb14f55a709 SHA-1: 92397ee173338ed70d09c1ba3f12fac09b4c3a8b SHA-256: 25877f561e142a37da0469a669ada94f710dbac6d7e570b1c78baa5b869f5cc3
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While no scripts were explicitly extracted, the presence of embedded URLs suggests an attempt to redirect the user to malicious or SEO-abused content. The ML classifier also flagged this PDF as malicious, increasing confidence in its suspicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/eric-johnson-guitar-play-along-volume-118-book-cd-hal.pdf
    • http://www.gorillawalker.com/psychology-a-student-s-handbook.pdf
    • http://www.gorillawalker.com/anglican-papalism.pdf
    • http://www.gorillawalker.com/the-heiress-of-linn-hagh-the-first-detective-lavender-mystery.pdf
    • http://www.gorillawalker.com/interpreting-land-records-kindle-edition.pdf
    • http://www.gorillawalker.com/math-for-everyone-combo-book-hardcover-7th-grade-math-algebra.pdf
    • http://www.gorillawalker.com/symmetrical-english-1-c5-macmillan-chess-library.pdf
    • http://www.gorillawalker.com/help-i-can-t-pay-my-bills-surviving-a-financial.pdf
    • http://www.gorillawalker.com/the-haunted-palace-or-the-horrors-of-ventoliene.pdf
    • http://www.gorillawalker.com/jenny-n-dad-the-love-story-of-a-very-young.pdf
    • http://www.gorillawalker.com/street-art-chile-by-rod-palmer-2008-paperback.pdf
    • http://www.gorillawalker.com/e-flat-alto-saxophone-solos-with-piano-estilian-caprice.pdf
    • http://www.gorillawalker.com/the-glass-palace-illusions-of-freedom-and-democracy-in-qatar.pdf
    • http://www.gorillawalker.com/killing-van-helsing-vampire-hunt-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/hanami-cologne-sakura-die-kirschbl.pdf
    • http://www.gorillawalker.com/sin-redemtption-and-sacrifice-a-biblical-and-patrisitic-study-analecta.pdf
    • http://www.gorillawalker.com/notes-on-a-cowardly-lion-the-biography-of-bert-lahr.pdf
    • http://www.gorillawalker.com/chandos-anthems-10-the-lord-is-my-light-11-let.pdf
    • http://www.gorillawalker.com/foundations-of-psychiatric-mental-health-nursing-a-clinical-approach-fifth.pdf
    • http://www.gorillawalker.com/heartthrob-a-hundred-years-of-beautiful-men.pdf
    • http://www.gorillawalker.com/the-history-of-classical-music-set-of-4-audio-cds.pdf
    • http://www.gorillawalker.com/return-to-dakistee-a-galaxy-unknown.pdf
    • http://www.gorillawalker.com/the-ghost-and-the-goth.pdf
    • http://www.gorillawalker.com/wrecked-a-regan-reilly-mystery.pdf
    • http://www.gorillawalker.com/owned-a-decadence-after-dark-novel.pdf
    • http://www.gorillawalker.com/in-the-beginning-beginner-and-elementary-go-books.pdf
    • http://www.gorillawalker.com/atomic-and-plasma-material-interaction-processes-in-controlled-thermonuclear-fusion.pdf
    • http://www.gorillawalker.com/danish-food-cooking-traditions-ingredients-tastes-techniques-over-60-classic.pdf
    • http://www.gorillawalker.com/outclass-the-competition-men-s-business-dressing-etiquette-men-s.pdf
    • http://www.gorillawalker.com/the-one-that-got-away-my-life-living-with-fred.pdf
    • http://www.gorillawalker.com/super-life-super-health.pdf
    • http://www.gorillawalker.com/the-complete-upmanship-including-gamesmanship-lifemanship-one-upmanship-supermanship.pdf
    • http://www.gorillawalker.com/anger-revolution-and-romanticism-cambridge-studies-in-romanticism.pdf
    • http://www.gorillawalker.com/climbing-sheer-vertical-cliffs-ds-usa-brent-kuemmerle-jarem-frye.pdf
    • http://www.gorillawalker.com/home-health-aide-on-the-go-in-service-lessons-vol.pdf
    • http://www.gorillawalker.com/defining-democracy-in-a-digital-age-political-support-on-social.pdf
    • http://www.gorillawalker.com/roenigk-s-dermatologic-surgery-current-techniques-in-procedural-dermatology.pdf
    • http://www.gorillawalker.com/law-reports-of-the-commonwealth.pdf
    • http://www.gorillawalker.com/jumping-over-fire.pdf
    • http://www.gorillawalker.com/the-pleasure-of-the-play.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.