Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a4a52ab0a65f9f0…

MALICIOUS

PDF

34.2 KB Created: 2019-11-10 05:16:30 +03:00 Authoring application: TeX (via MiKTeX pdfTeX-1.10b)
MD5: b342d6f7bf1c96993a21e5f5485cebcf SHA-1: a247195e1880be611235cb9abe395f3d1501695c SHA-256: 3a4a52ab0a65f9f091be0d9f7cca1e0a131793f531518763988c62e1f9b53557
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. A critical heuristic identified it as a PDF SEO link farm, containing 32 external links. The document body appears to be heavily obfuscated or corrupted, preventing analysis of its direct content. The primary attack pattern involves leveraging a large number of embedded URLs, likely for SEO manipulation or to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/angus-loughran-s-guide-to-champions-league-03-04-sporting.pdf
    • http://www.gorillawalker.com/researching-later-life-and-ageing-expanding-qualitative-research-horizons.pdf
    • http://www.gorillawalker.com/readings-in-russian-civilization-volume-ii-imperial-russia-1700-1917.pdf
    • http://www.gorillawalker.com/the-eroticlypse-attack-of-the-sex-zombies.pdf
    • http://www.gorillawalker.com/prentice-hall-science-electricity-and-magnetism.pdf
    • http://www.gorillawalker.com/love-s-cross-currents-a-year-s-letters.pdf
    • http://www.gorillawalker.com/iron-at-winterthur.pdf
    • http://www.gorillawalker.com/twin-peaks-an-access-guide-to-the-town.pdf
    • http://www.gorillawalker.com/sorry-i-pooped-in-your-shoe-and-other-heartwarming-letters.pdf
    • http://www.gorillawalker.com/the-computer-users-year-book-2001-2002-it-sites-book.pdf
    • http://www.gorillawalker.com/to-be-a-runner-how-racing-up-mountains-running-with.pdf
    • http://www.gorillawalker.com/focus-on-geometry.pdf
    • http://www.gorillawalker.com/cook-like-a-caterer-party-sized-recipes-for-entertaining-and.pdf
    • http://www.gorillawalker.com/come-let-us-adore-him-folio.pdf
    • http://www.gorillawalker.com/margaret-sanger-an-autobiography.pdf
    • http://www.gorillawalker.com/legal-bibliography-of-the-british-commonwealth-of-nations-being-the.pdf
    • http://www.gorillawalker.com/a-survey-of-paramattha-dhammas.pdf
    • http://www.gorillawalker.com/ambisexual.pdf
    • http://www.gorillawalker.com/research-methods-for-construction.pdf
    • http://www.gorillawalker.com/yu-gi-oh-34.pdf
    • http://www.gorillawalker.com/the-mcdougall-program-12-days-to-dynamic-health.pdf
    • http://www.gorillawalker.com/25-crockpot-meals-with-meat-beef-and-pork-delicious-easy.pdf
    • http://www.gorillawalker.com/magic-file-funfax-magic-tricks.pdf
    • http://www.gorillawalker.com/russian-edition.pdf
    • http://www.gorillawalker.com/cornucopia-leveraging-agriculture-to-improve-health-and-nutrition.pdf
    • http://www.gorillawalker.com/dr-karsten-fabian-folge-142-und-euch-soll-ich-verlassen.pdf
    • http://www.gorillawalker.com/deadly-company.pdf
    • http://www.gorillawalker.com/the-colored-pencil.pdf
    • http://www.gorillawalker.com/grain-growth-and-control-of-microstructure-and-texture-in-polycrystalline.pdf
    • http://www.gorillawalker.com/wilso-finite-math-plus-student-solutions-manual-plus-eduspace.pdf
    • http://www.gorillawalker.com/spring-awakening-summerset-abbey-trilogy.pdf
    • http://www.gorillawalker.com/raising-dragons-dragons-in-our-midst-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/foot-and-ankle-motion-analysis-clinical-treatment-and-technology.pdf
    • http://www.gorillawalker.com/cities-the-forces-that-shape-them.pdf
    • http://www.gorillawalker.com/my-first-torah.pdf
    • http://www.gorillawalker.com/afro-asia-revolutionary-political-and-cultural-connections-between-african-americans.pdf
    • http://www.gorillawalker.com/tao-te-ching-a-new-english-version-perennial-classics.pdf
    • http://www.gorillawalker.com/worth-dying-for-special-edition.pdf
    • http://www.gorillawalker.com/armoured-vehicles-handbook-2011.pdf
    • http://www.gorillawalker.com/colonial-america-1607-1763.pdf
    • http://www.gorillawalker.com/coo
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.