Malicious PDF — malware analysis report

Static analysis result for SHA-256 31e97c0a54265a25…

MALICIOUS

PDF

34.3 KB Created: 2019-09-02 22:32:02 +03:00 Authoring application: LaTeX with hyperref package (via pdfeTeX-1.10b)
MD5: a7c9b318789a30807810d60ad3c43f63 SHA-1: 499db855f3dd74d7fb34d106a4d1c3886c846f07 SHA-256: 31e97c0a54265a2567313e45ffa94b40820bf658db433a2793f5f524c1f845ea
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF documents hosted on the same domain, suggesting a link farm or a method to distribute potentially malicious content through seemingly legitimate-looking documents. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8261

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/designing-sustainable-residential-and-commercial-interiors-applying-concepts-and-practices.pdf
    • http://www.gorillawalker.com/jekka-s-culinary-herbs-a-guide-to-growing-and-using.pdf
    • http://www.gorillawalker.com/permanent-magnet-motor-technology-design-and-applications-electrical-engineering-and.pdf
    • http://www.gorillawalker.com/albert-camus-and-indian-thought.pdf
    • http://www.gorillawalker.com/the-heart-of-racial-justice-how-soul-change-leads-to.pdf
    • http://www.gorillawalker.com/i-saw-god-dancing-dreamseeker-poetry.pdf
    • http://www.gorillawalker.com/america-s-ballparks.pdf
    • http://www.gorillawalker.com/frognapped-araminta-spookie-book-3.pdf
    • http://www.gorillawalker.com/the-biography-and-typography-of-william-caxton.pdf
    • http://www.gorillawalker.com/technical-communication-strategies-for-today-olp-with-etext.pdf
    • http://www.gorillawalker.com/guided-meditation.pdf
    • http://www.gorillawalker.com/die-fiducie-von-quebec-und-der-trust-ein-vergleich-mit.pdf
    • http://www.gorillawalker.com/compasso-do-amor-compasso-da-sedu-o-livro-5-portuguese.pdf
    • http://www.gorillawalker.com/caffeine-and-its-effects-on-hyperactivity-alternate-plan-paper-mankato.pdf
    • http://www.gorillawalker.com/seismic-design-of-buildings-and-bridges-for-civil-and-structural.pdf
    • http://www.gorillawalker.com/evelyn-s-christmas-colouring-book.pdf
    • http://www.gorillawalker.com/housing-law-reports-2000-v-32.pdf
    • http://www.gorillawalker.com/allergy-in-practice.pdf
    • http://www.gorillawalker.com/lds-a-guide-to-addiction-recovery-and-healing-kindle-edition.pdf
    • http://www.gorillawalker.com/la-chimie-dans-la-societe-son-role-son-image-actes.pdf
    • http://www.gorillawalker.com/introduction-to-music-composition.pdf
    • http://www.gorillawalker.com/computer-music-synthesis-composition-and-performance.pdf
    • http://www.gorillawalker.com/cleveland-benjamin-s-dead-a-struggle-for-dignity-in-louisiana.pdf
    • http://www.gorillawalker.com/fiberpaedia-fiber-optics-key-parameters-explained.pdf
    • http://www.gorillawalker.com/super-searchers-cover-the-world-super-searchers-series.pdf
    • http://www.gorillawalker.com/minecraft-diary-of-a-legendary-minecraft-wolf-an-unofficial-minecraft.pdf
    • http://www.gorillawalker.com/medical-parasitology-a-self-instructional-text.pdf
    • http://www.gorillawalker.com/a-runners-guide-to-o-ahu.pdf
    • http://www.gorillawalker.com/ios-programming-cookbook-uikit-rich-ui-demos-beginning-ios-development.pdf
    • http://www.gorillawalker.com/gash-for-cash-the-jan-miller-story.pdf
    • http://www.gorillawalker.com/the-herman-miller-collection-the-1955-1956-catalog-schiffer-book.pdf
    • http://www.gorillawalker.com/evidence-in-criminal-cases.pdf
    • http://www.gorillawalker.com/dinosaurs-spitfires-sea-dragons-1991-365-pages-with-illustrations.pdf
    • http://www.gorillawalker.com/seven-step-job-search-cut-your-job-search-time-in.pdf
    • http://www.gorillawalker.com/tacit-subjects-belonging-and-same-sex-desire-among-dominican-immigrant.pdf
    • http://www.gorillawalker.com/chemical-deterioration-and-physical-instability-of-food-and-beverages-woodhead.pdf
    • http://www.gorillawalker.com/yucatan-mexico-guatemala-1-1-000-000-travel-map-laminated.pdf
    • http://www.gorillawalker.com/designing-scientific-applications-on-gpus-chapman-hall-crc-numerical-analysis.pdf
    • http://www.gorillawalker.com/tales-of-iloilo-a-boy-s-adventures-in-the-philippines.pdf
    • http://www.gorillawalker.com/cutting-out.pdf
    • http://www.gorillawalker.co
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.