Malicious PDF — malware analysis report

Static analysis result for SHA-256 2961536e57bc333c…

MALICIOUS

PDF

32.4 KB Created: 2020-01-10 17:21:10 +03:00 Authoring application: Adobe Illustrator CS3 (via Adobe PDF library 8.00)
MD5: 9d9059b63a5e2d345d67841508e4633d SHA-1: a56935d3b75cd6bb014bfd7e3044e9de130c7272 SHA-256: 2961536e57bc333cd6d48cd5aa8f3e8d9f6011c5f7a698896f65756d53cb2223
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests the document's primary purpose is to act as a link farm, likely for SEO manipulation or to distribute malicious URLs. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8008

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/issa-and-the-meaning-of-animals-a-buddhist-poet-s.pdf
    • http://www.gorillawalker.com/religion-and-religious-practice-in-the-seleucid-kingdom-studies-in.pdf
    • http://www.gorillawalker.com/the-modern-preacher-and-the-ancient-text-interpreting-and-preaching.pdf
    • http://www.gorillawalker.com/lost-found-objets-trouv-s-design-britannique-critique-french-edition.pdf
    • http://www.gorillawalker.com/out-of-the-shadow-a-russian-jewish-girlhood-on-the.pdf
    • http://www.gorillawalker.com/antitrust-law-policy-and-procedure-cases-materials-problems-2011-supplement.pdf
    • http://www.gorillawalker.com/my-big-fat-southern-gay-wedding-a-southern-thing-book.pdf
    • http://www.gorillawalker.com/weapons-tactics-and-strategy-curriculum-connections-civil-war.pdf
    • http://www.gorillawalker.com/teach-yourself-urdu-complete-course.pdf
    • http://www.gorillawalker.com/san-francisco-victorians.pdf
    • http://www.gorillawalker.com/american-custom-car.pdf
    • http://www.gorillawalker.com/boeing-airliners-747-757-767-in-colour.pdf
    • http://www.gorillawalker.com/google-analytics-demystified-a-hands-on-approach-second-edition.pdf
    • http://www.gorillawalker.com/your-time-is-done-now-slavery-resistance-and-defeat-the.pdf
    • http://www.gorillawalker.com/little-hide-and-seek-farm.pdf
    • http://www.gorillawalker.com/etudes-tableaux-op-33-kalmus-edition.pdf
    • http://www.gorillawalker.com/psychology-for-nurses-and-allied-health-professionals-applying-theory-to.pdf
    • http://www.gorillawalker.com/chants.pdf
    • http://www.gorillawalker.com/electronics-and-electrical-systems.pdf
    • http://www.gorillawalker.com/alabama-off-the-beaten-path-a-guide-to-unique-places.pdf
    • http://www.gorillawalker.com/lennon-mccartney-bass-play-along-volume-13.pdf
    • http://www.gorillawalker.com/to-love-another-person-a-spiritual-journey-through-les-miserables.pdf
    • http://www.gorillawalker.com/skills-for-families-skills-for-life-2nd-ed-how-to.pdf
    • http://www.gorillawalker.com/descendants.pdf
    • http://www.gorillawalker.com/antiguedades-judias-jewish-antiquities-clasica-spanish-edition.pdf
    • http://www.gorillawalker.com/12-concerti-grossi-op-6-concerto-no-7-in-b.pdf
    • http://www.gorillawalker.com/my-command-in-south-africa-1874-1878-comprising-experiences-of.pdf
    • http://www.gorillawalker.com/nostalgia-radio-sherlock-holmes.pdf
    • http://www.gorillawalker.com/cam-design-and-manufacture-second-edition-mechanical-engineering.pdf
    • http://www.gorillawalker.com/a-scarlet-cord.pdf
    • http://www.gorillawalker.com/thinking-like-a-lawyer-an-educator-s-guide-to-legal.pdf
    • http://www.gorillawalker.com/childe-harold-s-pilgrimage.pdf
    • http://www.gorillawalker.com/shantideva-how-to-wake-up-a-hero.pdf
    • http://www.gorillawalker.com/mexican-whiteboy.pdf
    • http://www.gorillawalker.com/a-week-in-the-1800s-ultimate-field-trip.pdf
    • http://www.gorillawalker.com/the-birthday-party-diet-exposed.pdf
    • http://www.gorillawalker.com/mexican-indian-costumes.pdf
    • http://www.gorillawalker.com/bind-the-soul-steel-and-stone.pdf
    • http://www.gorillawalker.com/assistive-technologies-pageburst-e-book-on-kno-retail-access-card.pdf
    • http://www.gorillawalker.com/bible-atlas-a-manual-of-biblical-geography-and-historyespecially-prepared.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.