Malicious PDF — malware analysis report

Static analysis result for SHA-256 2769456616df18e7…

MALICIOUS

PDF

43.5 KB Created: 2018-12-14 20:33:52 +03:00 Authoring application: (Infix Pro) (via PDFKit.NET 3.0.58.0)
MD5: e069f4db46f66cb9d15d06949dddb722 SHA-1: 965dcfeccbb0c701b139f8566aac3145cf82e93a SHA-256: 2769456616df18e7c66c65dcf791c0d885801b26f431813871e847020c2b7412
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and a critical heuristic for containing a large number of external links. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a link farm or a method to distribute further malicious content. No scripts were extracted, and the document body contained mostly obfuscated data.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8859

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/iran-sanctions-energy-arms-control-and-regime-change-csis-reports.pdf
    • http://www.gorillawalker.com/andorra-cadi.pdf
    • http://www.gorillawalker.com/the-anglo-arab-encounter-fiction-and-autobiography-by-arab-writers.pdf
    • http://www.gorillawalker.com/federal-rules-of-criminal-procedure-just-the-rules-series-kindle.pdf
    • http://www.gorillawalker.com/calculus-with-analytic-geometry-5e-complete-solutions-manual.pdf
    • http://www.gorillawalker.com/hunting-the-gugu.pdf
    • http://www.gorillawalker.com/anglo-israel-or-the-saxon-race-proved-to-be-the.pdf
    • http://www.gorillawalker.com/questions-for-the-movie-answer-man.pdf
    • http://www.gorillawalker.com/twelve-sonatas-op-5-kalmus-edition.pdf
    • http://www.gorillawalker.com/inspector-imanishi-investigates.pdf
    • http://www.gorillawalker.com/the-spinorial-chessboard-trieste-notes-in-physics.pdf
    • http://www.gorillawalker.com/who-was-pablo-picasso-who-was-kindle-edition.pdf
    • http://www.gorillawalker.com/sumter-flying-artillery-the-a-civil-war-history-of-the.pdf
    • http://www.gorillawalker.com/brick-flicks-60-iconic-movie-scenes-and-posters-to-make.pdf
    • http://www.gorillawalker.com/inventing-falsehood-making-truth-vico-and-neapolitan-painting-essays-in.pdf
    • http://www.gorillawalker.com/carving-in-the-round-7-projects-to-take-your-first.pdf
    • http://www.gorillawalker.com/lt-leary-commanding.pdf
    • http://www.gorillawalker.com/holt-mcdougal-larson-algebra-2-transparency-book-chapter-6-algebra.pdf
    • http://www.gorillawalker.com/recorder-magic-bk-1-descant-tutor.pdf
    • http://www.gorillawalker.com/ribstars-backyard-smoking-bbq-cookbook.pdf
    • http://www.gorillawalker.com/anything-you-say-can-and-will-be-used-against-you.pdf
    • http://www.gorillawalker.com/b-i-n-g-o-sing-a-story-handled-board.pdf
    • http://www.gorillawalker.com/the-soul-of-anime-collaborative-creativity-and-japan-s-media.pdf
    • http://www.gorillawalker.com/crossing-between-worlds-the-navajo-of-canyon-de-chelly.pdf
    • http://www.gorillawalker.com/bonnard-from-a-to-z-artists-from-a-to-z.pdf
    • http://www.gorillawalker.com/dundo-maroje-hrvatski-klasici-croatian-edition.pdf
    • http://www.gorillawalker.com/workbook-for-textbook-for-radiographic-positioning-and-related-anatomy-volume.pdf
    • http://www.gorillawalker.com/making-sustainability-work-best-practices-in-managing-and-measuring-corporate.pdf
    • http://www.gorillawalker.com/the-metabolic-profile-test.pdf
    • http://www.gorillawalker.com/premier-piano-course-theory-bk-5-alfred-s-premier-piano.pdf
    • http://www.gorillawalker.com/somewhere-in-the-world-right-now-reading-rainbow-book.pdf
    • http://www.gorillawalker.com/snowshoeing-skiing-colorado-s-backcountry-trails.pdf
    • http://www.gorillawalker.com/das-ultimative-burger-grillbuch-die-besten-rezepte-zum-burger-grillen.pdf
    • http://www.gorillawalker.com/clinical-pharmacology-and-dental-therapeutics.pdf
    • http://www.gorillawalker.com/hot-love-battles-sweet-victories-bitter-defeats-the-interracial-bwwm.pdf
    • http://www.gorillawalker.com/rigby-on-our-way-to-english-big-book-grade-5.pdf
    • http://www.gorillawalker.com/community-college-transfer-guide-2nd-edition.pdf
    • http://www.gorillawalker.com/cool-hotels-paris.pdf
    • http://www.gorillawalker.com/super-baby-food-cookbook-organic-baby-and-toddler-recipes.pdf
    • http://www.gorillawalker.com/torchwood-the-official-magazine-yearbook.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.