Malicious PDF — malware analysis report

Static analysis result for SHA-256 26855eb14cc6ac72…

MALICIOUS

PDF

34.9 KB Created: 2019-12-14 01:55:15 +03:00 Authoring application: PDFpen
MD5: f568a52199d974c3137d70255950b965 SHA-1: 07d5ae149193719836eabe373cccd551f092b7a4 SHA-256: 26855eb14cc6ac72975c69e0debce50bad5cf71ddd88e1e2b4a76f74c025138f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be SEO manipulation or a link farm designed to drive traffic to a specific domain, potentially for distributing malware or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8018

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/cuba-todos-culpables-lo-que-no-se-sabe-del-dictador.pdf
    • http://www.gorillawalker.com/new-south-african-keywords.pdf
    • http://www.gorillawalker.com/high-flying-stars-nba.pdf
    • http://www.gorillawalker.com/the-state-vs-nelson-mandela-the-trial-that-changed-south.pdf
    • http://www.gorillawalker.com/build-borrow-or-buy-solving-the-growth-dilemma.pdf
    • http://www.gorillawalker.com/with-only-my-violin-the-memoirs-of-stephane-grappelli.pdf
    • http://www.gorillawalker.com/technological-revolution-turning-points-in-world-history.pdf
    • http://www.gorillawalker.com/web-copy-that-sells-the-revolutionary-formula-for-creating-killer.pdf
    • http://www.gorillawalker.com/practical-process-control-tuning-and-troubleshooting.pdf
    • http://www.gorillawalker.com/battle-hymn-of-the-republic-waring-choral-series.pdf
    • http://www.gorillawalker.com/histoires-celebres-french-edition.pdf
    • http://www.gorillawalker.com/global-insights-people-and-cultures-review-book.pdf
    • http://www.gorillawalker.com/trails-of-the-angeles-100-hikes-in-the-san-gabriels.pdf
    • http://www.gorillawalker.com/rigby-pm-plus-individual-student-edition-gold-levels-21-22.pdf
    • http://www.gorillawalker.com/pathfinder-roleplaying-game-the-pathfinder-bestiary-publisher-paizo-publishing-llc.pdf
    • http://www.gorillawalker.com/imap-dublin.pdf
    • http://www.gorillawalker.com/through-a-reporter-s-eyes-the-life-of-stefan-banach.pdf
    • http://www.gorillawalker.com/all-about-the-green-the-teens-guide-to-finding-work.pdf
    • http://www.gorillawalker.com/the-pact-complete-book-1-our-journey-home-far-from.pdf
    • http://www.gorillawalker.com/corpus-methods-for-semantics-quantitative-studies-in-polysemy-and-synonymy.pdf
    • http://www.gorillawalker.com/ten-commandments-of-working-in-a-hostile-environment.pdf
    • http://www.gorillawalker.com/hands-on-therapy.pdf
    • http://www.gorillawalker.com/five-things-you-can-do-in-30-minutes-to-improve.pdf
    • http://www.gorillawalker.com/world-agriculture-in-disarray-trade-policy-research-centre.pdf
    • http://www.gorillawalker.com/cold-adapted-yeasts-biodiversity-adaptation-strategies-and-biotechnological-significance.pdf
    • http://www.gorillawalker.com/garment-manufacturing-technology-woodhead-publishing-series-in-textiles.pdf
    • http://www.gorillawalker.com/a-and-g-murray-and-the-cotton-mills-of-ancoats.pdf
    • http://www.gorillawalker.com/the-papers-of-james-madison-purchased-by-order-of-congress.pdf
    • http://www.gorillawalker.com/poems-to-shout-out-loud.pdf
    • http://www.gorillawalker.com/hope-for-him-hope-series-book-2-volume-2.pdf
    • http://www.gorillawalker.com/parental-involvement-in-childhood-education-building-effective-school-family-partnerships.pdf
    • http://www.gorillawalker.com/la-rondine-opera-vocal-score.pdf
    • http://www.gorillawalker.com/rodale-s-ultimate-encyclopedia-of-organic-gardening-the-indispensible-green.pdf
    • http://www.gorillawalker.com/amazing-plant-bodies-tiny-to-gigantic-plant-ology.pdf
    • http://www.gorillawalker.com/john-chambers-and-the-cisco-way-navigating-through-volatility.pdf
    • http://www.gorillawalker.com/stroke-syndromes-3ed.pdf
    • http://www.gorillawalker.com/free-style-fashion-photography-poses-positions-how-to-model-how.pdf
    • http://www.gorillawalker.com/forest-a-national-audubon-society-book.pdf
    • http://www.gorillawalker.com/rocket-propulsion-elements-7th-edition.pdf
    • http://www.gorillawalker.com/the-arctic-and-antarctic-trips.pdf
    • http://www.gori
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.