Malicious PDF — malware analysis report

Static analysis result for SHA-256 3653a1ba5f370296…

MALICIOUS

PDF

40.9 KB Created: 2018-11-30 20:57:43 +03:00 Authoring application: PageMaker 6.5 (via Acrobat Distiller 3.01 for Windows)
MD5: 1309f1f404158cebf73eb636a25b9e45 SHA-1: 95b29a60effd1c0736a1c6cd6ad9d454245b9a99 SHA-256: 3653a1ba5f37029628518424b3e83cc711b02546676824b8bac7ed39027ed979
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or distribution mechanism. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the sheer volume of embedded URLs points to a malicious intent, likely to redirect users to further malicious content or to manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/tanzia-ownership-of-the-old-world-the-end-of-the.pdf
    • http://www.gorillawalker.com/men-of-issachar-understand-the-times-know-what-to-do.pdf
    • http://www.gorillawalker.com/the-wound-and-the-bow-seven-studies-in-literature.pdf
    • http://www.gorillawalker.com/coin-magic.pdf
    • http://www.gorillawalker.com/magic-lovers-tower-volume-1-v-1.pdf
    • http://www.gorillawalker.com/jazz-volume-1-yaoi-v-1.pdf
    • http://www.gorillawalker.com/abe-lincoln-the-boy-who-loved-books.pdf
    • http://www.gorillawalker.com/g-i-joe-the-idw-collection-volume-2-g-i.pdf
    • http://www.gorillawalker.com/education-and-counselling-for-childbirth.pdf
    • http://www.gorillawalker.com/coaching-winning-soccer.pdf
    • http://www.gorillawalker.com/vivsguide-manhattan-an-undercover-look-at-the-city-s-cheap.pdf
    • http://www.gorillawalker.com/essential-finger-exercises-piano.pdf
    • http://www.gorillawalker.com/100-addition-worksheets-with-four-3-digit-addends-math-practice.pdf
    • http://www.gorillawalker.com/downside-up-and-other-poems-for-children.pdf
    • http://www.gorillawalker.com/supernatural-clwyd-folk-tales-of-north-east-wales.pdf
    • http://www.gorillawalker.com/tax-aspects-of-bankruptcy-law-and-practice.pdf
    • http://www.gorillawalker.com/curacao-travel-adventures-kindle-edition.pdf
    • http://www.gorillawalker.com/psycho-logic.pdf
    • http://www.gorillawalker.com/the-forbidden-zone.pdf
    • http://www.gorillawalker.com/vietnamese-traditional-medicine-a-social-history.pdf
    • http://www.gorillawalker.com/civilizational-identity-the-production-and-reproduction-of-civilizations-in-international.pdf
    • http://www.gorillawalker.com/water-towers.pdf
    • http://www.gorillawalker.com/the-overcoat-and-other-tales-of-good-and-evil.pdf
    • http://www.gorillawalker.com/virtual-clinical-excursions-online-and-print-workbook-for-maternity-and.pdf
    • http://www.gorillawalker.com/korea-we-lived-they-died.pdf
    • http://www.gorillawalker.com/new-markets-new-opportunities-economic-and-social-mobility-in-a.pdf
    • http://www.gorillawalker.com/manual-de-magia-pr.pdf
    • http://www.gorillawalker.com/how-to-run-seminars-and-workshops-presentation-skills-for-consultants.pdf
    • http://www.gorillawalker.com/acne-addio-italian-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/national-geographic-traveler-magazine-october-2012-discover-the-italian-secret.pdf
    • http://www.gorillawalker.com/by-duane-e-haines-neuroanatomy-an-atlas-of-structures-sections.pdf
    • http://www.gorillawalker.com/jennette-mccurdy-a-robbie-reader-robbie-readers-biographies.pdf
    • http://www.gorillawalker.com/light-working-with-available-and-photographic-lighting-amphoto-photography-workshop.pdf
    • http://www.gorillawalker.com/internet-dating-101-it-s-complicated-but-it-doesn-t.pdf
    • http://www.gorillawalker.com/how-to-be-your-own-stockbroker.pdf
    • http://www.gorillawalker.com/primary-school-gymnastics-teaching-movement-action-successfully.pdf
    • http://www.gorillawalker.com/real-world-multicore-embedded-systems.pdf
    • http://www.gorillawalker.com/passenger-ships-barrow-built.pdf
    • http://www.gorillawalker.com/gardens-of-the-spirit-2013-wall-calendar.pdf
    • http://www.gorillawalker.com/a-theory-of-the-drone.pdf
    • http://www.gorillawalker.com/g-i-joe-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.