Malicious PDF — malware analysis report

Static analysis result for SHA-256 38fd262b5d51b791…

MALICIOUS

PDF

44.6 KB Created: 2019-03-17 03:03:36 +03:00 Authoring application: Acrobat Distiller 7.0.5 (Windows)
MD5: 13cd5e71c962feca63302999a048f73d SHA-1: d78d2a86e598f7e322cfb428c117976a2f50d21d SHA-256: 38fd262b5d51b791489035f4b99e38b62078e883a9021c06333c181c5393ee81
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. The embedded URLs all point to the same domain, suggesting a coordinated effort to manipulate search engine results or distribute content from a central location. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/italian-self-propelled-guns-semoventi-m-41-and-m-42.pdf
    • http://www.gorillawalker.com/brown-dog-of-the-yaak-essays-on-art-and-activism.pdf
    • http://www.gorillawalker.com/the-story-of-the-26th-louisiana-infantry-in-the-service.pdf
    • http://www.gorillawalker.com/beer-blast-the-inside-story-of-the-brewing-industry-s.pdf
    • http://www.gorillawalker.com/gurps-iou-gurps-generic-universal-role-playing-system.pdf
    • http://www.gorillawalker.com/international-environmental-economics-theories-models-and-applications-to-climate-change.pdf
    • http://www.gorillawalker.com/cpt-changes-2006-an-insider-s-view-cpt-changes-an.pdf
    • http://www.gorillawalker.com/canon-and-biblical-interpretation-scripture-and-hermeneutics-series.pdf
    • http://www.gorillawalker.com/locker-room-victory-party-kindle-edition.pdf
    • http://www.gorillawalker.com/eye-tricks-incredible.pdf
    • http://www.gorillawalker.com/mechanics-m1-for-edexcel.pdf
    • http://www.gorillawalker.com/vertebral-fracture-in-osteoporosis.pdf
    • http://www.gorillawalker.com/to-annabella-pelican-from-thomas-hippopotamus.pdf
    • http://www.gorillawalker.com/rereading-modernism-new-directions-in-feminist-criticism-rle-women-feminism.pdf
    • http://www.gorillawalker.com/americans-in-paris-a-literary-anthology-library-of-america.pdf
    • http://www.gorillawalker.com/aqa-as-sociology-unit-1-families-and-households-student-support.pdf
    • http://www.gorillawalker.com/glazunov-alexander-concerto-in-a-minor-op-82-violin-and.pdf
    • http://www.gorillawalker.com/french-short-stories-2-parallel-text-parallel-text-penguin-french.pdf
    • http://www.gorillawalker.com/mene-easy-eats-simple-fast-delicious-moanalua-high-school-project.pdf
    • http://www.gorillawalker.com/henry-a-wallace-s-irrigation-frontier-on-the-trail-of.pdf
    • http://www.gorillawalker.com/a-woman-of-taste-memoirs-from-the-wine-world.pdf
    • http://www.gorillawalker.com/the-verging-cities-mountain-west-poetry-series.pdf
    • http://www.gorillawalker.com/the-garden-within-acidophilus-candida-connection.pdf
    • http://www.gorillawalker.com/ecoregions-the-ecosystem-geography-of-the-oceans-and-continents.pdf
    • http://www.gorillawalker.com/for-the-right-to-learn-malala-yousafzai-s-story-narrative.pdf
    • http://www.gorillawalker.com/frank-sinatra-centennial-songbook-paperback.pdf
    • http://www.gorillawalker.com/historical-markers-jacksonville-florida-historical-markers-series-book-30-kindle.pdf
    • http://www.gorillawalker.com/vocal-score-of-the-yeomen-of-the-guard-or-the.pdf
    • http://www.gorillawalker.com/how-to-grow-out-of-asthma-as-quickly-as-humanly.pdf
    • http://www.gorillawalker.com/vacation-stories-five-science-fiction-tales.pdf
    • http://www.gorillawalker.com/legendary-payback-twisted-part-2-kindle-edition.pdf
    • http://www.gorillawalker.com/kaylee-s-live-lesbian-sex-show-a-sex-in-public.pdf
    • http://www.gorillawalker.com/coping-with-copd-understanding-treating-and-living-with-chronic-obstructive.pdf
    • http://www.gorillawalker.com/becoming-queen-the-house-trageri-cycle-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/the-language-of-literature-vocabulary-and-spelling-book-grade-7.pdf
    • http://www.gorillawalker.com/introductory-phonology.pdf
    • http://www.gorillawalker.com/the-strange-case-of-william-mumler-spirit-photographer-fesler-lampert.pdf
    • http://www.gorillawalker.com/peoplesmart-facilitator-s-guide.pdf
    • http://www.gorillawalker.com/new-logo-volume-one.pdf
    • http://www.gorillawalker.com/the-progressive-era-and-race-reaction-and-reform-1900-1917.pdf
    • http://www.gorillawalker.com/international-environmental-economics-theories-models-and-appl
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.