Malicious PDF — malware analysis report

Static analysis result for SHA-256 373ad4564cf96a8b…

MALICIOUS

PDF

43.9 KB Created: 2018-12-14 21:27:47 +03:00 Authoring application: Adobe Acrobat 6.02 (via Adobe Acrobat 6.02 Paper Capture Plug-in)
MD5: 514e6328ec2f58a50dd79ac26ad166f9 SHA-1: c7197b5aea12e878e89467c36661b6cd315955a9 SHA-256: 373ad4564cf96a8ba13c83385aa5bf597ea975b72a619e510e6ccf25e91698df
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a large number of external links, suggesting a link farm or redirection tactic. The ML classifier also flagged the PDF as malicious. While no scripts were extracted, the sheer volume of links points to a malicious intent, likely to drive traffic to potentially harmful websites or for SEO manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/american-heart-association-quick-easy-cookbook-2nd-edition-more-than.pdf
    • http://www.gorillawalker.com/fields-of-logic-and-computation-essays-dedicated-to-yuri-gurevich.pdf
    • http://www.gorillawalker.com/calvert-the-raven-in-the-battle-of-baltimore-flying-through.pdf
    • http://www.gorillawalker.com/life-of-the-honeybee-nature-watch-lerner.pdf
    • http://www.gorillawalker.com/hockney-to-hodgkin-british-master-prints-1960-1980.pdf
    • http://www.gorillawalker.com/le-due-tigri-i-pirati-della-malesia-vol-4-italian.pdf
    • http://www.gorillawalker.com/network-routing-algorithms-protocols-and-architectures-the-morgan-kaufmann-series.pdf
    • http://www.gorillawalker.com/college-algebra-custom-edition-for-kaplan-university-taken-from-beginning.pdf
    • http://www.gorillawalker.com/sex-priests-and-power-anatomy-of-a-crisis.pdf
    • http://www.gorillawalker.com/201-simple-ideas-to-make-more-in-network-marketing.pdf
    • http://www.gorillawalker.com/letters-on-paraguay-comprising-an-account-of-a-four-years.pdf
    • http://www.gorillawalker.com/tumult-in-tenochtitl-n-saga-city-adventures-book-1.pdf
    • http://www.gorillawalker.com/mineral-textile.pdf
    • http://www.gorillawalker.com/the-challenges-of-calculating-the-benefits-of-providing-access-to.pdf
    • http://www.gorillawalker.com/marie-claire-hair-makeup.pdf
    • http://www.gorillawalker.com/full-color-cigar-labels-cd-rom-and-book-dover-full.pdf
    • http://www.gorillawalker.com/working-with-clay-an-introduction.pdf
    • http://www.gorillawalker.com/the-visible-word-experimental-typography-and-modern-art-1909-1923.pdf
    • http://www.gorillawalker.com/mtle-minnesota-middle-level-mathematics-5-8-practice-test-2.pdf
    • http://www.gorillawalker.com/functional-aspects-of-egyptian-ceramics-in-their-archaeological-context-proceedings.pdf
    • http://www.gorillawalker.com/shadow-of-a-doubt.pdf
    • http://www.gorillawalker.com/sophocles-ajax.pdf
    • http://www.gorillawalker.com/prank-call-girl-the-madam-diary-mysteries-book-1.pdf
    • http://www.gorillawalker.com/how-to-the-ultimate-songbook-for-all-skill-levels-vol.pdf
    • http://www.gorillawalker.com/topology-point-set-and-geometric.pdf
    • http://www.gorillawalker.com/poets-mind-between-light-and-dark.pdf
    • http://www.gorillawalker.com/fighting-ships-1850-1950.pdf
    • http://www.gorillawalker.com/drawing-for-beginners-guide-learn-how-to-draw-and-zentangle.pdf
    • http://www.gorillawalker.com/the-handbook-of-sustainable-refurbishment-non-domestic-buildings.pdf
    • http://www.gorillawalker.com/umm-kulthum-arabic-edition-great-songs-of-arabic-first-songs.pdf
    • http://www.gorillawalker.com/precision-bidding-and-precision-play.pdf
    • http://www.gorillawalker.com/that-man-3-that-man-trilogy.pdf
    • http://www.gorillawalker.com/photojournalism-and-the-origins-of-the-french-writer-house-museum.pdf
    • http://www.gorillawalker.com/forgotten-memories-mills-boon-love-inspired-suspense-swat-top-cops.pdf
    • http://www.gorillawalker.com/prostate-ca-treatment-differs-between-races-clinical-rounds-cancer-an.pdf
    • http://www.gorillawalker.com/external-parasites-of-swine-hog-lice-current-information-series-university.pdf
    • http://www.gorillawalker.com/street-talk-da-official-guide-to-hip-hop-urban-slanguage.pdf
    • http://www.gorillawalker.com/how-successful-people-grow-15-ways-to-get-ahead-in.pdf
    • http://www.gorillawalker.com/smoky-dragons.pdf
    • http://www.gorillawalker.com/popular-collection-christmas-trombone-piano-keyboard-sheet-music.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.