Malicious PDF — malware analysis report

Static analysis result for SHA-256 2684eb8e7855357e…

MALICIOUS

PDF

42.6 KB Created: 2018-12-15 21:32:03 +03:00 Authoring application: - (via Apache FOP Version 0.93)
MD5: 8a520d31da0121515bc8600d0b23ae5a SHA-1: 4cb8284ec75a98a93d727ced98992c2f9374c2f6 SHA-256: 2684eb8e7855357e8c40769f0205a1731b33efabd9f481cbbbd4b137e3a7378a
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a significant number of embedded URLs pointing to external resources, a technique often used for SEO spam or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this behavior, indicating a likely attempt to manipulate search engine results or redirect users. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/starlit-ballroom-siren-publishing-classic.pdf
    • http://www.gorillawalker.com/depression-my-witness-your-solution-five-easy-steps-to-reprogramme.pdf
    • http://www.gorillawalker.com/improving-reading-comprehension-and-speed-skimming-and-scanning-reading-for.pdf
    • http://www.gorillawalker.com/the-girl-who-kicked-the-hornet-s-nest-book-3.pdf
    • http://www.gorillawalker.com/aprende-git-y-de-camino-github-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/rockhounding-nevada-2nd-a-guide-to-the-state-s-best.pdf
    • http://www.gorillawalker.com/drawing-on-the-right-side-of-the-brain.pdf
    • http://www.gorillawalker.com/french-vocabulary-barron-s-vocabulary-series.pdf
    • http://www.gorillawalker.com/a-christmas-carol-a-christmas-musical-for-children-about-giving.pdf
    • http://www.gorillawalker.com/the-pattern-of-evolution.pdf
    • http://www.gorillawalker.com/casualidades-coincidencias-y-serendipias-de-la-historia-unabridged-audible-audio.pdf
    • http://www.gorillawalker.com/daniel-x-watch-the-skies-kindle-edition.pdf
    • http://www.gorillawalker.com/anglesey-villages.pdf
    • http://www.gorillawalker.com/nocturnal-interlude-nocturnal-lives-book-3-kindle-edition.pdf
    • http://www.gorillawalker.com/chinese-readers-series-d-green-readers-bedtime-talent-show-big.pdf
    • http://www.gorillawalker.com/the-songwriting-labyrinth-practical-tools-to-decode-the-mysterious-craft.pdf
    • http://www.gorillawalker.com/livewire-real-lives-denzel-washington-paperback.pdf
    • http://www.gorillawalker.com/municipalities-in-peril-the-abi-guide-to-chapter-9-second.pdf
    • http://www.gorillawalker.com/disciple-makers.pdf
    • http://www.gorillawalker.com/aesthetics-a-beginner-s-guide-beginner-s-guides.pdf
    • http://www.gorillawalker.com/the-economics-and-politics-of-socialism-economic-systems-comparative-economics.pdf
    • http://www.gorillawalker.com/midnight-in-sicily-on-art-food-history-travel-and-la.pdf
    • http://www.gorillawalker.com/drugs-in-pregnancy-and-lactation-a-reference-guide-to-fetal.pdf
    • http://www.gorillawalker.com/25-recipes-for-a-healthier-and-tastier-lifestyle-kindle-edition.pdf
    • http://www.gorillawalker.com/padi-diver-manual-revised-edition-skin-diving-scuba-diving-open.pdf
    • http://www.gorillawalker.com/evil-never-dies.pdf
    • http://www.gorillawalker.com/canadian-whisky-the-portable-expert.pdf
    • http://www.gorillawalker.com/methods-and-perspectives-in-intellectual-property-atrip-intellectual-property-series.pdf
    • http://www.gorillawalker.com/oscilloscopes-fourth-edition-how-to-use-them-how-they-work.pdf
    • http://www.gorillawalker.com/there-is-a-carrot-in-my-ear-and-other-noodle.pdf
    • http://www.gorillawalker.com/solid-oxide-fuel-cell-technology-principles-performance-and-operations-woodhead.pdf
    • http://www.gorillawalker.com/the-fiddler-of-the-reels-and-other-stories.pdf
    • http://www.gorillawalker.com/physical-volcanology-development-in-solid-earth-geophysics.pdf
    • http://www.gorillawalker.com/jensen-s-vocabulary.pdf
    • http://www.gorillawalker.com/the-battle-for-leningrad-1941-1944-modern-war-studies.pdf
    • http://www.gorillawalker.com/studies-in-ichthyology-and-oceanography-off-coastal-peru-bulletin-of.pdf
    • http://www.gorillawalker.com/insect-cell-culture-engineering-biotechnology-and-bioprocessing.pdf
    • http://www.gorillawalker.com/in-the-moonlight-mist.pdf
    • http://www.gorillawalker.com/servsafe-coursebook-with-online-exam-voucher-6th-edition-myservsafelab-series.pdf
    • http://www.gorillawalker.com/process-intensification-technologies-for-green-chemistry-engineering-solutions-for-sustainable.pdf
    • http://www.gorillawalker.com/rockhounding-nevada-2nd-a-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.