Malicious PDF — malware analysis report

Static analysis result for SHA-256 27d3539a010a8609…

MALICIOUS

PDF

41.5 KB Created: 2019-04-05 07:56:30 +03:00 Authoring application: Adobe InDesign CS3 (5.0.4) (via Adobe PDF Library 8.0)
MD5: 67db4184792909c6596974514431658a SHA-1: 29c3888f30f8846af436a2779ad3ae794d12eb71 SHA-256: 27d3539a010a8609174da39512f84ae09cbc69572bba3302aaf7d08fa5385bbe
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. A critical heuristic identified a large number of embedded external links, suggesting a link farm or distribution mechanism. The document body is heavily obfuscated and does not provide clear textual lures. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8698

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/seasons-of-the-heart-once-upon-a-summer-winds-of.pdf
    • http://www.gorillawalker.com/kyle-s-new-stepbrother-iv-sweet-summer-gone-nick-and.pdf
    • http://www.gorillawalker.com/soybean-production-in-the-midsouth.pdf
    • http://www.gorillawalker.com/maison-martin-margiela-street-special-edition-vols-1-2.pdf
    • http://www.gorillawalker.com/pilates-forme-minceur-1dvd-french-edition.pdf
    • http://www.gorillawalker.com/into-the-trenches.pdf
    • http://www.gorillawalker.com/international-business-handbook-republic-of-korea.pdf
    • http://www.gorillawalker.com/rebound-to-better-health-the-physiology-of-rebound-exercise.pdf
    • http://www.gorillawalker.com/li-shi-de-bei-mian-jia-zhifang-zi-xuan-ji.pdf
    • http://www.gorillawalker.com/organic-soup-recipes-kindle-edition.pdf
    • http://www.gorillawalker.com/human-factors-in-cotton-culture-a-study-in-the-social.pdf
    • http://www.gorillawalker.com/the-only-chili-recipe-you-need-kindle-edition.pdf
    • http://www.gorillawalker.com/the-happiest-baby-the-ultimate-guide-to-raise-a-happy.pdf
    • http://www.gorillawalker.com/tex-rickard-boxing-s-greatest-promoter.pdf
    • http://www.gorillawalker.com/a-complete-guide-to-the-engine-houses-of-west-cornwall.pdf
    • http://www.gorillawalker.com/the-2007-2012-outlook-for-snowboarding-boots-for-step-in.pdf
    • http://www.gorillawalker.com/annals-of-the-keepers-deception-volume-2.pdf
    • http://www.gorillawalker.com/killjoy-a-cop-s-fight-against-child-sexual-abuse.pdf
    • http://www.gorillawalker.com/guns-of-the-old-west-the-firearms-classics-library.pdf
    • http://www.gorillawalker.com/dodge-pickups-1939-1978-photo-album.pdf
    • http://www.gorillawalker.com/anton-chekhov-s-plays-norton-critical-edition.pdf
    • http://www.gorillawalker.com/the-science-of-golf-putting-a-complete-guide-for-researchers.pdf
    • http://www.gorillawalker.com/hydrological-chemical-and-biological-processes-of-transformation-and-transport-of.pdf
    • http://www.gorillawalker.com/the-book-of-imaan-the-basis-reality-and-invalidation-of.pdf
    • http://www.gorillawalker.com/mobile-lives-international-library-of-sociology.pdf
    • http://www.gorillawalker.com/the-franklin-conspiracy-an-astonishing-solution-to-the-lost-arctic.pdf
    • http://www.gorillawalker.com/super-smart-information-strategies-get-ready-for-a-winning-science.pdf
    • http://www.gorillawalker.com/kaplan-sheinwold-system-of-winning-bridge.pdf
    • http://www.gorillawalker.com/chinese-medicine-treatment-of-viral-hepatitis-points-for-symmetric-yuan.pdf
    • http://www.gorillawalker.com/radar-system-analysis-and-modeling-artech-house-radar-library.pdf
    • http://www.gorillawalker.com/the-warrior-song-of-king-gesar-paperback.pdf
    • http://www.gorillawalker.com/olive-oil-an-italian-pantry-italian-pantry-collection.pdf
    • http://www.gorillawalker.com/history-of-rome-complete-kindle-edition.pdf
    • http://www.gorillawalker.com/basic-carpentry-techniques.pdf
    • http://www.gorillawalker.com/pappa-in-doubt.pdf
    • http://www.gorillawalker.com/think-like-a-tycoon-how-to-make-a-million-in.pdf
    • http://www.gorillawalker.com/un-comienzo-magico-spanish-edition.pdf
    • http://www.gorillawalker.com/the-genesis-shield.pdf
    • http://www.gorillawalker.com/giant-steps-abridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/all-pooped-out-and-other-gross-expressions-it-s-just.pdf
    • http://www.gorillawalker.com/pilates-forme-minceur-1dvd-french-edition
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.