Malicious PDF — malware analysis report

Static analysis result for SHA-256 3435fd18f86968ab…

MALICIOUS

PDF

40.5 KB Created: 2018-12-07 18:27:58 +03:00 Authoring application: Acrobat Distiller 5.0 (Windows) (via Adobe PDF Library 9.9)
MD5: a729ba4813d329b19b918afb4257c754 SHA-1: b7e5605545d26eac07f7acef81478ea0b8318abd SHA-256: 3435fd18f86968ab449c65c0f4ef9f38624939e5dcb88384bcc8187170cbe985
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, identified by the PDF_SEO_LINK_FARM heuristic. The SE_PASSWORD_ARCHIVE_LURE heuristic suggests a common tactic to bypass security scanners by instructing the user to open a password-protected archive, though no explicit password instructions were found in the DOC BODY. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/madeleine-albright-women-in-politics.pdf
    • http://www.gorillawalker.com/mapsco-williamson-county-street-guide-including-marble-falls-and-burnet.pdf
    • http://www.gorillawalker.com/forbidden-temptation-texas-stallions-4-siren-publishing-classic.pdf
    • http://www.gorillawalker.com/todo-lo-que-nunca-quiso-saber-sobre-contabilidad-pero-necesita.pdf
    • http://www.gorillawalker.com/carbohydrate-addict-s-calorie-counter.pdf
    • http://www.gorillawalker.com/guildpact-ravnica-cycle-book-ii.pdf
    • http://www.gorillawalker.com/rspb-first-book-of-minibeasts.pdf
    • http://www.gorillawalker.com/choosing-sides-loyalists-in-revolutionary-america-american-controversies.pdf
    • http://www.gorillawalker.com/the-apple-way-12-management-lessons-from-the-world-s.pdf
    • http://www.gorillawalker.com/jade-and-the-surprise-party-magic-ballerina-book-20.pdf
    • http://www.gorillawalker.com/managing-hot-flushes-with-group-cognitive-behaviour-therapy-an-evidence.pdf
    • http://www.gorillawalker.com/the-creation-a-poem.pdf
    • http://www.gorillawalker.com/prepper-s-survival-pantry-a-beginner-s-guide-to-modern.pdf
    • http://www.gorillawalker.com/cool-jobs-for-handy-helpers-ways-to-make-money-doing.pdf
    • http://www.gorillawalker.com/learning-through-digital-game-design-and-building-in-a-participatory.pdf
    • http://www.gorillawalker.com/fodor-s-madrid-25-best-full-color-travel-guide.pdf
    • http://www.gorillawalker.com/adaptable-teaching-kitchens-in-further-education-building-bulletin.pdf
    • http://www.gorillawalker.com/2-day-diet-track-your-weight-loss-progress-with-calorie.pdf
    • http://www.gorillawalker.com/the-pressure-distribution-on-a-hyperbolic-paraboloid-roof.pdf
    • http://www.gorillawalker.com/feedback-control-of-large-scale-systems-prentice-hall-international-series.pdf
    • http://www.gorillawalker.com/the-king-of-tars-middle-english-texts.pdf
    • http://www.gorillawalker.com/international-cases-in-sustainable-travel-tourism.pdf
    • http://www.gorillawalker.com/bad-boyes.pdf
    • http://www.gorillawalker.com/monochrome-darkness-and-light-in-contemporary-art.pdf
    • http://www.gorillawalker.com/the-ashrae-greenguide-second-edition-the-ashrae-green-guide-series.pdf
    • http://www.gorillawalker.com/the-prophecies-of-the-brahan-seer.pdf
    • http://www.gorillawalker.com/boxing-fitness-a-guide-to-getting-fighting-fit-fitness-series.pdf
    • http://www.gorillawalker.com/the-drowning-lesson.pdf
    • http://www.gorillawalker.com/dried-flower-gifts-creating-decorative-arrangements.pdf
    • http://www.gorillawalker.com/steck-vaughn-en-parajes-leveled-reader-bookroom-package-me-questa.pdf
    • http://www.gorillawalker.com/239-ibiza-formentera-1-50-000.pdf
    • http://www.gorillawalker.com/public-relations-bibliography-1986-1987.pdf
    • http://www.gorillawalker.com/the-tender-flame-mail-order-bride-series-3.pdf
    • http://www.gorillawalker.com/mcgraw-hill-education-500-gmat-verbal-questions-to-know-by.pdf
    • http://www.gorillawalker.com/the-effective-investor.pdf
    • http://www.gorillawalker.com/globalization-and-the-american-south.pdf
    • http://www.gorillawalker.com/dash-diet-heart-health-high-blood-pressure-cholesterol-hypertension-wt.pdf
    • http://www.gorillawalker.com/sepulchres-and-other-poems.pdf
    • http://www.gorillawalker.com/reminiscences-of-a-stock-operator-illustrated.pdf
    • http://www.gorillawalker.com/trematode-infections-and-diseases-of-man-and-animals.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.