Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c9429f3fbda8bd5…

MALICIOUS

PDF

42.6 KB Created: 2019-03-17 01:55:44 +03:00 Authoring application: dvips 5.83 (MiKTeX 1.20b) Copyright 1998 Radical Eye Software (via Acrobat Distiller 4.0 for Windows)
MD5: 5d63f8e251715479ba27912b60b02d91 SHA-1: 1de9d8af3eb6aabd783a1810d9a4d14607f01e07 SHA-256: 2c9429f3fbda8bd55468110ef1ad72198e296b2e228b00a826ea6dac1eb8ce40
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be the creation of a link farm, potentially for SEO manipulation or to serve as a distribution point for further malicious content, although no direct payload download was observed in this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8698

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/can-non-europeans-think.pdf
    • http://www.gorillawalker.com/hunted-heretic-the-life-and-death-of-michael-servetus-1511.pdf
    • http://www.gorillawalker.com/changes-of-mind-a-holonomic-theory-of-the-evolution-of.pdf
    • http://www.gorillawalker.com/rifleman-sahib-the-recollections-of-an-officer-of-the-bombay.pdf
    • http://www.gorillawalker.com/clinical-practice-of-cognitive-therapy-with-children-and-adolescents-the.pdf
    • http://www.gorillawalker.com/fodor-s-around-atlanta-with-kids-60-great-things-to.pdf
    • http://www.gorillawalker.com/the-amazing-power-of-deliberate-intent-part-i-unabridged-audible.pdf
    • http://www.gorillawalker.com/the-civil-military-fabric-of-weimar-foreign-policy-princeton-legacy.pdf
    • http://www.gorillawalker.com/rand-mcnally-birmingham-al-easyfinder-plus-map.pdf
    • http://www.gorillawalker.com/a-dangerous-liaison-a-revelatory-new-biography-of-simone-debeauvoir.pdf
    • http://www.gorillawalker.com/mccall-s-cooking-school-recipe-card-pies-pastry-29-cranberry.pdf
    • http://www.gorillawalker.com/using-multivariate-statistics-4th-edition.pdf
    • http://www.gorillawalker.com/end-of-empires-european-decolonisation-1919-80-access-to-history.pdf
    • http://www.gorillawalker.com/val-and-vince-first-sounds.pdf
    • http://www.gorillawalker.com/covered-calls-consistent-cash-flow.pdf
    • http://www.gorillawalker.com/chicken-soup-for-the-teacher-s-soul.pdf
    • http://www.gorillawalker.com/coronary-artery-disease-essentials-of-prevention-rehab-programs.pdf
    • http://www.gorillawalker.com/fundamentals-of-data-warehouses.pdf
    • http://www.gorillawalker.com/ali-an-american-champion.pdf
    • http://www.gorillawalker.com/and-then-i-had-kids-encouragement-for-mothers-of-young.pdf
    • http://www.gorillawalker.com/jesus-a-special-baby-word-picture-books.pdf
    • http://www.gorillawalker.com/the-dragon-s-queen-dragon-lords-book-9-unabridged-audible.pdf
    • http://www.gorillawalker.com/mild-cognitive-impairment-pipeline-review-q4-2010-download-pdf-digital.pdf
    • http://www.gorillawalker.com/international-fiber-corporation-providing-solutions-for-an-evolving-marketplace-an.pdf
    • http://www.gorillawalker.com/divorce-forms-for-washington-forms-only.pdf
    • http://www.gorillawalker.com/faith-cure-divine-healing-in-the-holiness-and-pentecostal-movements.pdf
    • http://www.gorillawalker.com/contemporary-nationalism-civic-ethnocultural-and-multicultural-politics.pdf
    • http://www.gorillawalker.com/haskell-w-harr-drum-method-book-two-for-band-and.pdf
    • http://www.gorillawalker.com/qualitative-consumer-and-marketing-research.pdf
    • http://www.gorillawalker.com/grandma-s-wheelchair-concept-books-level-1.pdf
    • http://www.gorillawalker.com/kissing-in-italian.pdf
    • http://www.gorillawalker.com/jackrabbit-a-just-cause-universe-novel-the-just-cause-universe.pdf
    • http://www.gorillawalker.com/what-is-mr-winkle-step-back-in-time-with-mr.pdf
    • http://www.gorillawalker.com/the-great-smoky-mountains-and-thunderhead-peak.pdf
    • http://www.gorillawalker.com/the-complete-container-garden.pdf
    • http://www.gorillawalker.com/the-19th-century-artists-writers-and-composers.pdf
    • http://www.gorillawalker.com/prontuario-di-diritto-penitenziario-italian-edition.pdf
    • http://www.gorillawalker.com/a-worthy-pursuit.pdf
    • http://www.gorillawalker.com/fitting-in-and-getting-happy-how-conformity-to-societal-norms.pdf
    • http://www.gorillawalker.com/the-nina-the-pinta-and-the-santa-maria-first-book.pdf
    • http://www.gorillawalker.com/the-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.