Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b2bd9d90b7b2001…

MALICIOUS

PDF

44.7 KB Created: 2018-12-03 17:09:25 +03:00 Authoring application: ScanSnap Manager (via Acrobat Distiller 10.1.7 (Windows))
MD5: 7b610a38f431195a93dbea01e4a3480e SHA-1: 5b4395b325bf1aec002f232949ffa7e6f291accf SHA-256: 3b2bd9d90b7b2001f7b640adc3f2906b68a6bd187c5def39c4113132cbd3a601
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. The embedded URLs suggest a link farm or distribution mechanism for other malicious content, rather than a direct user-facing lure. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9844

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/spec-ops-case-studies-in-special-operations-warfare-theory-and.pdf
    • http://www.gorillawalker.com/nitrogen-transformations-and-nitrogen-balances-in-scandinavian-soils-nitrogen-utilisation.pdf
    • http://www.gorillawalker.com/it-s-a-good-life-if-you-don-t-weaken.pdf
    • http://www.gorillawalker.com/the-personal-touch-encouraging-others-through-hospitality.pdf
    • http://www.gorillawalker.com/essential-maths-skills-for-secondary-science-answer-book.pdf
    • http://www.gorillawalker.com/mouth-watering-chicken-recipes-for-a-quick-chicken-dish-that.pdf
    • http://www.gorillawalker.com/pursuing-a-promise-a-history-of-african-americans-at-georgia.pdf
    • http://www.gorillawalker.com/outdoor-carpentry-make-it-yourself.pdf
    • http://www.gorillawalker.com/courage-under-fire-true-stories-from-the-frontline.pdf
    • http://www.gorillawalker.com/did-god-kill-jesus-searching-for-love-in-history-s.pdf
    • http://www.gorillawalker.com/breve-historia-del-fascismo-spanish-edition.pdf
    • http://www.gorillawalker.com/travels-in-north-america-volume-2-with-geological-observations-on.pdf
    • http://www.gorillawalker.com/unlocking-the-secrets-hidden-in-handwriting.pdf
    • http://www.gorillawalker.com/navigate-2-advantage-access-for-gerontological-nursing.pdf
    • http://www.gorillawalker.com/liquor-webster-s-specialty-crossword-puzzles.pdf
    • http://www.gorillawalker.com/orson-welles-shakespeare-and-popular-culture.pdf
    • http://www.gorillawalker.com/saddam-king-of-terror.pdf
    • http://www.gorillawalker.com/how-to-get-better-at-chess-chess-masters-on-their.pdf
    • http://www.gorillawalker.com/water-lifting-devices-a-handbook-for-users-and-choosers.pdf
    • http://www.gorillawalker.com/savage-awakening-an-alpha-pack-novel.pdf
    • http://www.gorillawalker.com/techno-nationalism-and-techno-globalism-conflict-and-cooperation-integrating-national.pdf
    • http://www.gorillawalker.com/robot-building-for-teens.pdf
    • http://www.gorillawalker.com/the-natural-history-of-barbados-in-ten-books-primary-source.pdf
    • http://www.gorillawalker.com/principios-de-bioqu.pdf
    • http://www.gorillawalker.com/federal-disability-law-in-a-nutshell-nutshell-series.pdf
    • http://www.gorillawalker.com/pure-inductive-logic-perspectives-in-logic.pdf
    • http://www.gorillawalker.com/memory-is-our-home-loss-and-remembering-three-generations-in.pdf
    • http://www.gorillawalker.com/life-s-too-short-to-fold-fitted-sheets.pdf
    • http://www.gorillawalker.com/design-for-business-volume-2.pdf
    • http://www.gorillawalker.com/karmic-relationships-vol-vi.pdf
    • http://www.gorillawalker.com/thomas-jefferson-a-public-life-a-private-life-first-men.pdf
    • http://www.gorillawalker.com/patterns-of-redemption-in-virgil-s-georgics-cambridge-classical-studies.pdf
    • http://www.gorillawalker.com/heaven-of-drums-lannan-translation-selection-curbstone-press.pdf
    • http://www.gorillawalker.com/the-little-one-s-bible-with-talkabouts-and-prayers.pdf
    • http://www.gorillawalker.com/the-victorians-usborne-history-of-britain.pdf
    • http://www.gorillawalker.com/big-book-of-kitchen-appliance-recipes-nitty-gritty-cookbooks-kitchen.pdf
    • http://www.gorillawalker.com/resena-historica-estadistica-y-descriptiva-con-tradiciones-orales-de-las.pdf
    • http://www.gorillawalker.com/the-eaton-rifles-the-men-of-company-h.pdf
    • http://www.gorillawalker.com/junten-los-pedazos-spanish-edition.pdf
    • http://www.gorillawalker.com/f1-through-the-eyes-of-damon-hill-inside-the-world.pdf
    • http://www.gorillawalker.com/essential-maths-skills-for-secondary-science-ans
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.