Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a9abd6dd797d610…

MALICIOUS

PDF

43.7 KB Created: 2019-03-17 01:50:39 +03:00 Authoring application: Adobe InDesign CC 2014 (Macintosh) (via Adobe PDF Library 11.0)
MD5: 9709426c75ac6dd8436e7fcbbdb72220 SHA-1: d99d93faa87c1d185817db3b25e67127a61f80f2 SHA-256: 2a9abd6dd797d610dac720c2b290741650581564d4b02a9cb1013b8f0aaf9f2a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of external links, primarily pointing to other PDF files on the same domain, which is characteristic of a link farm or SEO spam. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the sheer volume of outbound links suggests a malicious intent to drive traffic or potentially distribute further malicious content through these linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/eating-well-on-a-budget.pdf
    • http://www.gorillawalker.com/the-range-of-systems-theory-the-dissertation-draft-in-the.pdf
    • http://www.gorillawalker.com/awakening-the-third-eye-discovering-the-true-essence-of-recapitulation.pdf
    • http://www.gorillawalker.com/geographers-biobibliographical-studies-volume-34.pdf
    • http://www.gorillawalker.com/globetrotter-travel-guide-new-zealand.pdf
    • http://www.gorillawalker.com/deathlok-vol-2-man-versus-machine.pdf
    • http://www.gorillawalker.com/twelve-chinamen-and-a-woman.pdf
    • http://www.gorillawalker.com/the-thistle-and-the-jade-a-celebration-of-150-years.pdf
    • http://www.gorillawalker.com/love-lust-and-rebellion-new-approaches-to-georg-buchner.pdf
    • http://www.gorillawalker.com/creative-surface-design-painting-stamping-stenciling-and-embossing-fabric-more.pdf
    • http://www.gorillawalker.com/naughty-neighbor-new-adult-older-woman-younger-man-romance-short.pdf
    • http://www.gorillawalker.com/voices-of-the-other-children-s-literature-and-the-postcolonial.pdf
    • http://www.gorillawalker.com/understanding-income-statements-finance-fundamentals-for-the-non-financial-manager.pdf
    • http://www.gorillawalker.com/introduction-to-octonion-and-other-non-associative-algebras-in-physics.pdf
    • http://www.gorillawalker.com/let-s-draw-manga-sexy-gals-paperback.pdf
    • http://www.gorillawalker.com/computers-in-video-production-video-bookshelf.pdf
    • http://www.gorillawalker.com/proceedings-of-the-1997-1st-electronic-packaging-technology-conference.pdf
    • http://www.gorillawalker.com/acquisitions-and-mergers-in-canada.pdf
    • http://www.gorillawalker.com/hierarchy-in-international-relations-cornell-studies-in-political-economy.pdf
    • http://www.gorillawalker.com/workbook-to-accompany-the-second-edition-of-donald-m-ayers.pdf
    • http://www.gorillawalker.com/advanced-automotive-welding-pro-series.pdf
    • http://www.gorillawalker.com/relaxation-a-comprehensive-manual-for-adults-children-and-children-with.pdf
    • http://www.gorillawalker.com/who-do-they-think-they-are-teenage-girls-and-their.pdf
    • http://www.gorillawalker.com/the-prophet-of-pirate-s-cove.pdf
    • http://www.gorillawalker.com/incest-as-child-abuse-research-and-applications.pdf
    • http://www.gorillawalker.com/the-meditations-of-marcus-aurelius-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/after-thought-mentalism-from-the-magic-bar.pdf
    • http://www.gorillawalker.com/across-the-universe-original-keys-for-singers-vocal-piano.pdf
    • http://www.gorillawalker.com/music-of-the-american-indian-plains-comanche-cheyenne-kiowa-caddo.pdf
    • http://www.gorillawalker.com/at-last-a-reading-method-for-every-child.pdf
    • http://www.gorillawalker.com/reptiles-a-question-and-answer-book-animal-kingdom-questions-and.pdf
    • http://www.gorillawalker.com/turtles-tortoises-and-terrapins-survivors-in-armor.pdf
    • http://www.gorillawalker.com/ten-from-infinity-mass-market-paperback.pdf
    • http://www.gorillawalker.com/introduction-to-the-music-industry-an-entrepreneurial-approach.pdf
    • http://www.gorillawalker.com/mission-santa-cruz-volume-2.pdf
    • http://www.gorillawalker.com/the-war-a-memoir.pdf
    • http://www.gorillawalker.com/new-ideas-for-miniature-bobbin-lace.pdf
    • http://www.gorillawalker.com/komtesse-mizzi-oder-der-familientag-kom-die-in-einem-akt.pdf
    • http://www.gorillawalker.com/relative-significance-of-insurance-and-actuarial-journals-and-articles-a.pdf
    • http://www.gorillawalker.com/an-introduction-to-soil-grouting.pdf
    • http://www.gorillawalker.com/twelve-chinamen-and-a-woman.p
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.