Malicious PDF — malware analysis report

Static analysis result for SHA-256 31a0b08d155ac870…

MALICIOUS

PDF

47.2 KB Created: 2018-11-26 08:22:42 +03:00 Authoring application: pdfTeX-1.40.14 (via Revision 5)
MD5: 31e9a9636648d5d360dc4d414831817d SHA-1: f1ba09358596857e9826e32aabf7827487608f32 SHA-256: 31a0b08d155ac870aa72a703479997e11f4d226cb9e588182b117df252d70624
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains an embedded script payload and a large number of external PDF links, indicating a malicious intent. The ML classifier also flagged this PDF as malicious. The embedded script likely attempts to download and execute a second-stage payload, although its exact function is obscured. The extensive link farm suggests an SEO poisoning or content distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8868

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/most-cost-effective-psoriasis-treatment-is-methotrexate-psoriasis-an-article.pdf
    • http://www.gorillawalker.com/ruskin-routledge-revivals-the-great-victorian.pdf
    • http://www.gorillawalker.com/summer-of-the-ancient-silki-the-girl-of-many-scarves.pdf
    • http://www.gorillawalker.com/raising-dragons.pdf
    • http://www.gorillawalker.com/the-division-of-wrongs-a-historical-comparative-study.pdf
    • http://www.gorillawalker.com/complete-poems-of-heinrich-heine-a-modern-english-version.pdf
    • http://www.gorillawalker.com/algebraic-groups-and-their-birational-invariants-translations-of-mathematical-monographs.pdf
    • http://www.gorillawalker.com/ciencia-y-salud-con-la-llave-de-las-escrituras-spanish.pdf
    • http://www.gorillawalker.com/classroom-skills-for-nurse-educators.pdf
    • http://www.gorillawalker.com/david-busch-s-nikon-d60-guide-to-digital-slr-photography.pdf
    • http://www.gorillawalker.com/the-march-of-chess-ideas-how-the-century-s-greatest.pdf
    • http://www.gorillawalker.com/lymphedema-a-concise-compendium-of-theory-and-practice.pdf
    • http://www.gorillawalker.com/i-share-creation-vocal-full-score.pdf
    • http://www.gorillawalker.com/tour-of-mont-blanc-complete-two-way-trekking-guide-trekking.pdf
    • http://www.gorillawalker.com/rockabilly-bass-slap-technique-creating-bass-lines-the-rudiments-of.pdf
    • http://www.gorillawalker.com/bundle-principles-of-everyday-behavior-analysis-with-printed-access-card.pdf
    • http://www.gorillawalker.com/electrical-engineering-international-library-of-technology-137-design-of-direct.pdf
    • http://www.gorillawalker.com/op-transylvania-chron-1-dark-tides-for-vampire-the-dark.pdf
    • http://www.gorillawalker.com/dna-array-image-analysis-nuts-bolts-nuts-bolts-series.pdf
    • http://www.gorillawalker.com/animal-cells-let-s-relate-to-genetics.pdf
    • http://www.gorillawalker.com/brand-bible-the-complete-guide-to-building-designing-and-sustaining.pdf
    • http://www.gorillawalker.com/japanese-style-gardens-bbg-guides-for-a-greener-planet.pdf
    • http://www.gorillawalker.com/notes-on-the-state-of-virginia-the-norton-library.pdf
    • http://www.gorillawalker.com/by-lennard-zinn-zinn-the-art-of-road-bike-maintenance.pdf
    • http://www.gorillawalker.com/f-hrung-als-herausforderung-ein-erfahrungs-und-impulsgeber-f-r.pdf
    • http://www.gorillawalker.com/today-s-nursing-leader-managing-succeeding-excelling.pdf
    • http://www.gorillawalker.com/state-secrets-the-calvert-series-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/singer-s-musical-theatre-anthology-volume-5-baritone-bass-book.pdf
    • http://www.gorillawalker.com/dog-heaven-somewhere-over-the-rainbow-bridge.pdf
    • http://www.gorillawalker.com/formatting-tips-for-publishing-a-createspace-book-kindle-direct-ebook.pdf
    • http://www.gorillawalker.com/safety-through-design.pdf
    • http://www.gorillawalker.com/children-s-contact-with-incarcerated-parents-implications-for-policy-and.pdf
    • http://www.gorillawalker.com/the-new-mayo-clinic-cookbook-byforberg.pdf
    • http://www.gorillawalker.com/fighting-eoka-the-british-counter-insurgency-campaign-on-cyprus-1955.pdf
    • http://www.gorillawalker.com/women-s-empowerment-and-demographic-processes-moving-beyond-cairo-international.pdf
    • http://www.gorillawalker.com/islam-its-beauty-wisdom.pdf
    • http://www.gorillawalker.com/2012-for-twentysomethings-a-young-voter-s-guide-to-the.pdf
    • http://www.gorillawalker.com/the-incoherence-of-the-philosophers-2nd-edition-brigham-young-university.pdf
    • http://www.gorillawalker.com/grateful-dead-what-a-long-strange-trip-it-s-been.pdf
    • http://www.gorillawalker.com/how-will-you-measure-your-life.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_000028c1.bin
0dbdbb037170554cc1d1c7d332f942ba500cfa16b8de8f5675d7eb570ae8446d		 pdf-embedded-script PDF decompressed stream script payload at offset 0x28C1 37726 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.