Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a0ff8216a3b76e7…

MALICIOUS

PDF

34.4 KB Created: 2020-01-17 19:19:46 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 9.3.2 (Windows))
MD5: 47be6dc6dc2e0ccb40bf15647d3fb44e SHA-1: b64e91bccaf3f1a36351ee1f1f35e6192944d3cc SHA-256: 2a0ff8216a3b76e7d77356b626fb4fd7eb61797bc88f29aa1f91c5e735e40093
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm, likely intended for SEO manipulation or to distribute further malicious content through these links. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8263

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/transforming-mission-paradigm-shifts-in-theology-of-mission-american-society.pdf
    • http://www.gorillawalker.com/the-complete-encyclopedia-of-fossils-a-comprehensive-guide-to-fossils.pdf
    • http://www.gorillawalker.com/the-next-evolution-of-marketing-connect-with-your-customers-by.pdf
    • http://www.gorillawalker.com/everything-at-last-a-magnolia-beach-novel.pdf
    • http://www.gorillawalker.com/smart-ball-marketing-the-myth-and-managing-the-reality-of.pdf
    • http://www.gorillawalker.com/key-maths-9-1-pupils-book-revised-edition.pdf
    • http://www.gorillawalker.com/the-complete-ring-trilogy-ring-spiral-loop.pdf
    • http://www.gorillawalker.com/the-incipience-of-the-cosmos.pdf
    • http://www.gorillawalker.com/long-distance-hiking.pdf
    • http://www.gorillawalker.com/never-cry-arp-and-other-great-adventures.pdf
    • http://www.gorillawalker.com/the-eagle-of-the-ninth.pdf
    • http://www.gorillawalker.com/andy-griffith-just-as-i-am-30-favorite-old-time.pdf
    • http://www.gorillawalker.com/good-value.pdf
    • http://www.gorillawalker.com/sexual-orientation-and-rights-the-international-library-of-essays-on.pdf
    • http://www.gorillawalker.com/sunset-summer-confidential.pdf
    • http://www.gorillawalker.com/georgia-nature-weekends-52-adventures-in-nature-nature-weekend-series.pdf
    • http://www.gorillawalker.com/why-macrobiotics-is-my-favorite-big-word.pdf
    • http://www.gorillawalker.com/alternative-lithographic-technologies-vii-proceedings-of-spie.pdf
    • http://www.gorillawalker.com/genocide-world-issues.pdf
    • http://www.gorillawalker.com/responsive-web-design-with-html5-and-css3-second-edition.pdf
    • http://www.gorillawalker.com/immersionplus-german-with-listening-guide-german-edition.pdf
    • http://www.gorillawalker.com/eel-on-reef-black-goat.pdf
    • http://www.gorillawalker.com/cycling-along-the-canals-of-new-york-500-miles-of.pdf
    • http://www.gorillawalker.com/medicine-in-mexico-from-aztec-herbs-to-betatrons-texas-pan.pdf
    • http://www.gorillawalker.com/editions-alecto-original-graphics-multiple-originals-1960-1981.pdf
    • http://www.gorillawalker.com/the-limitless-city-a-primer-on-the-urban-sprawl-debate.pdf
    • http://www.gorillawalker.com/30-days-math-division-series-4-digit-dividends-2-digit.pdf
    • http://www.gorillawalker.com/the-official-guide-to-jazz-dancing-allen-dow-with-mike.pdf
    • http://www.gorillawalker.com/careers-for-music-lovers-and-other-tuneful-types-mcgraw-hill.pdf
    • http://www.gorillawalker.com/lord-of-the-grrr-s-a-10-book-paranormal-shifter.pdf
    • http://www.gorillawalker.com/drug-war-mexico-politics-neoliberalism-and-violence-in-the-new.pdf
    • http://www.gorillawalker.com/the-graphic-canon-vol-1-from-the-epic-of-gilgamesh.pdf
    • http://www.gorillawalker.com/writing-skills-ii.pdf
    • http://www.gorillawalker.com/postcolonial-piracy-media-distribution-and-cultural-production-in-the-global.pdf
    • http://www.gorillawalker.com/gluten-free-in-lizard-lick-100-gluten-free-recipes-for.pdf
    • http://www.gorillawalker.com/greek-gods-bearing-gifts-titan-pawn-kindle-edition.pdf
    • http://www.gorillawalker.com/oxford-handbook-of-oral-and-maxillofacial-surgery-oxford-handbooks-1st.pdf
    • http://www.gorillawalker.com/kyoto-nara-the-soul-of-japan.pdf
    • http://www.gorillawalker.com/the-new-leviathan-how-the-left-wing-money-machine-shapes.pdf
    • http://www.gorillawalker.com/how-to-build-a-speech-recognition-application-second-edition-a.pdf
    • http://www.gorillawalker.com/andy-griffith-just-as-i-am-3
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.