Malicious PDF — malware analysis report

Static analysis result for SHA-256 36940b0cf200575c…

MALICIOUS

PDF

43.2 KB Created: 2018-12-15 08:10:31 +03:00 Authoring application: PScript5.dll Version 5.2.2 (via Acrobat Distiller 7.0.5 (Windows))
MD5: d86cad1ac72f0315754e29181f0e727e SHA-1: d347d7ce19adfccd69a18ac737c039f6bc55d189 SHA-256: 36940b0cf200575c43717ceac8027cc1dd7c096acb4a9d5a6d8caa4012c3da09
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this sample as malicious. The embedded URLs point to a single domain, suggesting a coordinated effort to distribute content or manipulate search engine results. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/spatial-analysis-in-geomorphology.pdf
    • http://www.gorillawalker.com/thomas-guide-sacramento-solano-counties-including-portions-of-placer-el.pdf
    • http://www.gorillawalker.com/the-fatal-link-the-connection-between-school-shooters-and-the.pdf
    • http://www.gorillawalker.com/electronic-commerce-2012-managerial-and-social-networks-perspectives-7th-edition.pdf
    • http://www.gorillawalker.com/drawn-by-love-a-history-of-the-dominican-sisters-of.pdf
    • http://www.gorillawalker.com/sex-between-men-an-intimate-history-of-the-sex-lives.pdf
    • http://www.gorillawalker.com/why-ben-carson-is-the-new-ronald-reagan-5-reasons.pdf
    • http://www.gorillawalker.com/quartet-on-an-intrada-from-the-16th-century-for-4.pdf
    • http://www.gorillawalker.com/the-social-impact-of-bomb-destruction.pdf
    • http://www.gorillawalker.com/the-cry-for-myth.pdf
    • http://www.gorillawalker.com/alfred-rhythm-etudes-tuba.pdf
    • http://www.gorillawalker.com/crustacea-guide-of-the-world.pdf
    • http://www.gorillawalker.com/blame-it-on-the-dog-a-modern-history-of-the.pdf
    • http://www.gorillawalker.com/butterflies-insects.pdf
    • http://www.gorillawalker.com/conversation-analysis-second-language-acquisition-research-series.pdf
    • http://www.gorillawalker.com/black-enterprise-guide-to-technology-for-entrepreneurs.pdf
    • http://www.gorillawalker.com/mcdougal-littell-literature-student-edition-grade-8-2008.pdf
    • http://www.gorillawalker.com/handbook-of-alien-species-in-europe-invading-nature-springer-series.pdf
    • http://www.gorillawalker.com/christ-in-christian-tradition-volume-two-part-one-the-development.pdf
    • http://www.gorillawalker.com/picture-atlas.pdf
    • http://www.gorillawalker.com/i-like-hong-kong-art-and-deterritorialization.pdf
    • http://www.gorillawalker.com/anime-fan-communities-transcultural-flows-and-frictions.pdf
    • http://www.gorillawalker.com/paradigm-shifts-in-christian-witness-insights-from-anthropology-communication-and.pdf
    • http://www.gorillawalker.com/walking-israel-a-personal-search-for-the-soul-of-a.pdf
    • http://www.gorillawalker.com/lange-flash-cards-pharmacology.pdf
    • http://www.gorillawalker.com/how-odd-of-god-chosen-for-the-curious-vocation-of.pdf
    • http://www.gorillawalker.com/sight-size-portraiture.pdf
    • http://www.gorillawalker.com/exploring-sephardic-customs-and-traditions.pdf
    • http://www.gorillawalker.com/the-spirit-of-saint-francis-inspiring-words-from-pope-francis.pdf
    • http://www.gorillawalker.com/chilton-s-repair-and-tune-up-guide-blazer-jimmy-1969.pdf
    • http://www.gorillawalker.com/eight-ballets-and-madrigals-1598.pdf
    • http://www.gorillawalker.com/an-imperialist-love-story-desert-romances-and-the-war-on.pdf
    • http://www.gorillawalker.com/singapore-math-grade-5.pdf
    • http://www.gorillawalker.com/i-forgot-to-tell-you-ballet-school-confidential-kindle-edition.pdf
    • http://www.gorillawalker.com/eminent-dogs-dangerous-men.pdf
    • http://www.gorillawalker.com/heroes-return.pdf
    • http://www.gorillawalker.com/glorious-soups-for-entertaining.pdf
    • http://www.gorillawalker.com/the-cowboy-s-christmas-family-harlequin-american-romance.pdf
    • http://www.gorillawalker.com/florida-s-fabulous-canoe-and-kayak-trail-guide-williams-winston.pdf
    • http://www.gorillawalker.com/smut.pdf
    • http://www.gorillawalker.com/sex-between-m
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.