Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f8cdbe98175308c…

MALICIOUS

PDF

45.6 KB Created: 2018-12-02 10:56:35 +03:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 5.0 (Windows))
MD5: 4477088928177a297962ed762c72f4d3 SHA-1: 2fae22487f2d0c0b6d27dde8e03471aa88784060 SHA-256: 2f8cdbe98175308c8dd58b192045794e150eb921ba96aa1c1fafd84c6f3d5db6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier and contains a large number of embedded links to external PDF files, suggesting a link farm or content distribution tactic. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with 32 external links. While no scripts were extracted, the sheer volume of links points to a non-standard document purpose, likely to manipulate search engine results or distribute content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8812

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/30-day-spending-detox-the-simple-plan-to-save-money.pdf
    • http://www.gorillawalker.com/why-do-buses-come-in-threes-the-hidden-mathematics-of.pdf
    • http://www.gorillawalker.com/identificacion-de-lutzomyia-spp-diptera-psychodidae-grupo-verrucarum-por-medio.pdf
    • http://www.gorillawalker.com/luis-de-le-n-the-names-of-christ-classics-of.pdf
    • http://www.gorillawalker.com/let-s-remember-when-texas-belonged-to-mexico.pdf
    • http://www.gorillawalker.com/falling-down-funny-living-with-epilepsy-a-view-from-the.pdf
    • http://www.gorillawalker.com/advertising-land-rover-1948-71.pdf
    • http://www.gorillawalker.com/gordon-goodwin-big-phat-play-along-drums-book-cd.pdf
    • http://www.gorillawalker.com/afro-european-conference-for-industrial-advancement-proceedings-of-the-first.pdf
    • http://www.gorillawalker.com/how-literature-plays-with-the-brain-the-neuroscience-of-reading.pdf
    • http://www.gorillawalker.com/marine-mammals-of-the-world-a-comprehensive-guide-to-their.pdf
    • http://www.gorillawalker.com/twenty-million-tons-under-the-sea-the-daring-capture-of.pdf
    • http://www.gorillawalker.com/kafka-s-the-castle-and-the-critical-imagination-literary-criticism.pdf
    • http://www.gorillawalker.com/wood-first-facts-materials.pdf
    • http://www.gorillawalker.com/when-love-is-a-lie-narcissistic-partners-the-pathological-relationship.pdf
    • http://www.gorillawalker.com/life-in-ancient-mesopotamia-peoples-of-the-ancient-world.pdf
    • http://www.gorillawalker.com/lazar-s-mission-jack-lazar-series-volume-3.pdf
    • http://www.gorillawalker.com/stamping-through-astronomy.pdf
    • http://www.gorillawalker.com/super-savings-investing-in-savings-bonds-is-a-smart-way.pdf
    • http://www.gorillawalker.com/civil-rights-stories-law-stories.pdf
    • http://www.gorillawalker.com/the-borzoi-handbook-for-writers-the-borzoi-practice-book-for.pdf
    • http://www.gorillawalker.com/political-parties-in-britain-1783-1867-lancaster-pamphlets.pdf
    • http://www.gorillawalker.com/forex-trading-secrets-little-dirty-secrets-and-weird-but-profitable.pdf
    • http://www.gorillawalker.com/the-relic-seacliff-high-mystery-book-3.pdf
    • http://www.gorillawalker.com/the-road-to-omaha-a-novel-kindle-edition.pdf
    • http://www.gorillawalker.com/trade-development-and-political-economy-essays-in-honour-of-anne.pdf
    • http://www.gorillawalker.com/devoured.pdf
    • http://www.gorillawalker.com/cupcake-cousins-book-1-cupcake-cousins.pdf
    • http://www.gorillawalker.com/saddles-and-sin-lonesome-point-texas-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/maya-angelou-bloom-s-modern-critical-views.pdf
    • http://www.gorillawalker.com/the-legend-of-painted-pony-and-the-western-wind-wild.pdf
    • http://www.gorillawalker.com/japanese-calligraphy.pdf
    • http://www.gorillawalker.com/ireland-genealogy-family-history-of-counties-kildare-wicklow-carlow.pdf
    • http://www.gorillawalker.com/parents-in-a-pressure-cooker-a-guide-to-responsible-loving.pdf
    • http://www.gorillawalker.com/the-protos-mandate-a-scientific-novel-science-and-fiction.pdf
    • http://www.gorillawalker.com/come-for-dinner-memorable-meals-to-share-with-friends.pdf
    • http://www.gorillawalker.com/the-architect-as-worker-immaterial-labor-the-creative-class-and.pdf
    • http://www.gorillawalker.com/baby-duck-and-the-wolf-rosen-real-readers-stem-and.pdf
    • http://www.gorillawalker.com/missouri-curiosities-quirky-characters-roadside-oddities-other-offbeat-stuff-curiosities.pdf
    • http://www.gorillawalker.com/sweet-caress.pdf
    • http://www.gorillawalker.com/let-s-remem
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.