Malicious PDF — malware analysis report

Static analysis result for SHA-256 359d7eb3e659f308…

MALICIOUS

PDF

43.8 KB Created: 2018-12-02 10:55:25 +03:00 Authoring application: - (via Mac OS X 10.6.7 Quartz PDFContext)
MD5: 2e7dc057edc95362536b8459c074a612 SHA-1: b79f7dae76ff48e128c545e63bad2194012f7e2d SHA-256: 359d7eb3e659f30872a484516d5ce8d796779ff421270aa997eba08147788d09
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or to distribute a large volume of content, potentially malicious, from a single domain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/vengeance-in-black-spain-s-costa-del-sol-a-new.pdf
    • http://www.gorillawalker.com/boy-toy-kindle-edition.pdf
    • http://www.gorillawalker.com/cisco-extends-leadership-in-integrated-network-security-an-article-from.pdf
    • http://www.gorillawalker.com/advanced-mechanics-of-materials.pdf
    • http://www.gorillawalker.com/the-nuclear-force-the-force-which-binds-quarks-into-protons.pdf
    • http://www.gorillawalker.com/the-greatest-newspaper-dot-to-dot-puzzles-vol-7.pdf
    • http://www.gorillawalker.com/melbourne-street-directory-ubd-street-directories.pdf
    • http://www.gorillawalker.com/sound-and-fury-two-powerful-lives-one-fateful-friendship.pdf
    • http://www.gorillawalker.com/ukulele-learner-s-pack-with-cd-3-book-set-and.pdf
    • http://www.gorillawalker.com/american-work-four-centuries-of-black-and-white-labor.pdf
    • http://www.gorillawalker.com/complete-baby-and-child-care-complete-book.pdf
    • http://www.gorillawalker.com/social-trends-37th-edition.pdf
    • http://www.gorillawalker.com/getting-started-in-softball-helpful-tips-for-first-time-coaches.pdf
    • http://www.gorillawalker.com/brando-unzipped-marlon-brando-bad-boy-megastar-sexual-outlaw.pdf
    • http://www.gorillawalker.com/emergency-care-for-hazardous-materials-exposure-2e.pdf
    • http://www.gorillawalker.com/simple-photogrammetry.pdf
    • http://www.gorillawalker.com/lao-tse-tao-te-ching.pdf
    • http://www.gorillawalker.com/the-beatles-complete-easy-guitar-edition.pdf
    • http://www.gorillawalker.com/ancient-roman-technology-spotlight-on-ancient-civilizations-rome.pdf
    • http://www.gorillawalker.com/violent-delights-violent-ends-sex-race-and-honor-in-colonial.pdf
    • http://www.gorillawalker.com/creative-numerology-year-book-6-your-yearly-monthly-weekly-daily.pdf
    • http://www.gorillawalker.com/learn-german-101-basic-dialogues-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/the-annapolis-book-of-seamanship-2nd-edition-revised.pdf
    • http://www.gorillawalker.com/pocket-picture-guide-to-gastroenterology-pocket-picture-guides-to-clinical.pdf
    • http://www.gorillawalker.com/the-film-editing-room-handbook-how-to-tame-the-chaos.pdf
    • http://www.gorillawalker.com/stochastic-structural-dynamics-2-new-practical-applications-2nd-international-conference.pdf
    • http://www.gorillawalker.com/honest-abe-lincoln-easy-to-read-stories-about-abraham-lincoln.pdf
    • http://www.gorillawalker.com/historical-atlases-the-first-three-hundred-years-1570-1870.pdf
    • http://www.gorillawalker.com/core-curriculum-for-maternal-newborn-nursing-4th-fourth-edition-text.pdf
    • http://www.gorillawalker.com/men-of-achievement-inventors.pdf
    • http://www.gorillawalker.com/an-lisis-comparativo-de-resultados-de-sap2000-y-ansys-civilfem.pdf
    • http://www.gorillawalker.com/my-first-sticker-encyclopedia-farm-animals.pdf
    • http://www.gorillawalker.com/how-your-house-works-a-visual-guide-to-understanding-maintaining.pdf
    • http://www.gorillawalker.com/no-strange-fire-a-novel-about-the-amish-barn-fires.pdf
    • http://www.gorillawalker.com/operative-techniques-in-colon-and-rectal-surgery.pdf
    • http://www.gorillawalker.com/deep-plunge-book-3-of-the-soulshares-series.pdf
    • http://www.gorillawalker.com/the-age-of-louis-xiv-the-rise-of-modern-diplomacy.pdf
    • http://www.gorillawalker.com/rick-steves-pocket-munich-salzburg.pdf
    • http://www.gorillawalker.com/vw-beetle-motorbooks-calendar.pdf
    • http://www.gorillawalker.com/oral-history-december-1974-institute-of-papua-new-guinea-studies.pdf
    • http://www.gorillawalker.com/cisco-extends-leadership-in-integrated
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.