Malicious PDF — malware analysis report

Static analysis result for SHA-256 3494c51cb3358f90…

MALICIOUS

PDF

42.6 KB Created: 2019-04-06 12:03:00 +03:00 Authoring application: FrameMaker 7.1 (via Acrobat Distiller 7.0.5 (Windows))
MD5: fe5d1cb0dc421867cab559ef38b6e76a SHA-1: 9ce3bcc3621eaa7a79182067208f4cb78c6aa374 SHA-256: 3494c51cb3358f90cd0e562982629307317568193078600fcd916e48ce2abbd3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The embedded URLs suggest a link farm or SEO poisoning attack, aiming to drive traffic to the linked content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/where-to-wear-san-francisco-shopping-guide.pdf
    • http://www.gorillawalker.com/proverbs-2010-square-wall-multilingual-edition.pdf
    • http://www.gorillawalker.com/spinach-days-johns-hopkins-poetry-and-fiction.pdf
    • http://www.gorillawalker.com/student-solutions-manual-for-differential-equations-and-boundary-value-problems.pdf
    • http://www.gorillawalker.com/ken-en-verstaan-wiskunde-graad-10-afrikaans-edition.pdf
    • http://www.gorillawalker.com/national-pool-waterpark-lifeguard-training.pdf
    • http://www.gorillawalker.com/seafood-learn-to-cook-chinese-dishes-chinese-english-edition.pdf
    • http://www.gorillawalker.com/the-importance-of-being-earnest-norton-critical-editions-by-wilde.pdf
    • http://www.gorillawalker.com/precision-rifle-b-i-b-l-e-ballistics-in-battlefield.pdf
    • http://www.gorillawalker.com/momotaro.pdf
    • http://www.gorillawalker.com/absurdities-and-realities-of-special-education-the-best-of-ants.pdf
    • http://www.gorillawalker.com/animalia-picture-puffins.pdf
    • http://www.gorillawalker.com/bean-blossom-dreams-with-a-new-afterword-a-city-family.pdf
    • http://www.gorillawalker.com/marrakech-topographical-map-atlas-mountains-morocco-map.pdf
    • http://www.gorillawalker.com/medical-school-interviews-all-you-need-to-know-the-knowledge.pdf
    • http://www.gorillawalker.com/a-cidade-e-as-serras-portuguese-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/jeremiah-1-20-a-new-translation-with-introduction-and-commentary.pdf
    • http://www.gorillawalker.com/symphony-no-4-for-2-pianos-4-hands.pdf
    • http://www.gorillawalker.com/skin-care-ukhod-za-kozhey.pdf
    • http://www.gorillawalker.com/analysis-of-measured-helicopter-rotor-pressure-distributions.pdf
    • http://www.gorillawalker.com/the-story-of-art-pocket-edition-paperback.pdf
    • http://www.gorillawalker.com/a-monastery-within-tales-from-the-buddhist-path.pdf
    • http://www.gorillawalker.com/times-of-troubles-britain-s-war-in-northern-ireland.pdf
    • http://www.gorillawalker.com/gay-2-zee-a-dictionary-of-sex-subtext-and-the.pdf
    • http://www.gorillawalker.com/corporate-governance-and-ethics.pdf
    • http://www.gorillawalker.com/the-mile-end-cookbook-redefining-jewish-comfort-food-from-hash.pdf
    • http://www.gorillawalker.com/aspies-on-mental-health-speaking-for-ourselves-adults-speak-out.pdf
    • http://www.gorillawalker.com/how-to-draw-superheroes-with-colored-pencils-in-realistic-style.pdf
    • http://www.gorillawalker.com/201-killer-cover-letters-third-edition.pdf
    • http://www.gorillawalker.com/traffic-system-analysis-for-engineers-and-planners.pdf
    • http://www.gorillawalker.com/implementing-the-electrical-safety-program.pdf
    • http://www.gorillawalker.com/create-food-technology-student-book.pdf
    • http://www.gorillawalker.com/grannie-s-world-record-collard-green.pdf
    • http://www.gorillawalker.com/fodor-s-india-best-of-the-subcontinent.pdf
    • http://www.gorillawalker.com/research-methods-a-practical-guide-for-the-social-sciences.pdf
    • http://www.gorillawalker.com/dump-dinners-cookbook-quick-easy-dump-dinner-recipes-for-the.pdf
    • http://www.gorillawalker.com/hal-leonard-the-martin-ukulele-the-little-instrument-that-helped.pdf
    • http://www.gorillawalker.com/going-in-blind.pdf
    • http://www.gorillawalker.com/child-abuse-straight-talk-about.pdf
    • http://www.gorillawalker.com/marianske-lazne-panoramaticka-mapa-marienbad-panoramatische-karte-stadtfuhrer-panoramic-map.pdf
    • http://www.gorillawalker.com/seafood-learn-to-cook-chinese-dishes-chinese-english-edition
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.