Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c46b0a131574e43…

MALICIOUS

PDF

49.2 KB Created: 2018-12-15 20:10:57 +03:00 Authoring application: Adobe PageMaker 7.0 (via Acrobat Distiller 5.0.5 (Windows))
MD5: bbb85f105bf9d5a8e80ebc041333ea1f SHA-1: 31e59795ea6fe47686cd24360ddd37da83fc316b SHA-256: 3c46b0a131574e438df4c86d6b6da582c876203ef62010aec10bb7db50469be2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or to distribute a large volume of content, potentially malicious, from a single domain. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8876

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-approaching-crisis-being-a-review-of-dr-bushnell-s.pdf
    • http://www.gorillawalker.com/solomon-northup-s-twelve-years-a-slave-1841-1853-re.pdf
    • http://www.gorillawalker.com/em-1110-1-2009-architectural-concrete-engineering-and-design-31.pdf
    • http://www.gorillawalker.com/design-of-biomedical-devices-and-systems-second-edition.pdf
    • http://www.gorillawalker.com/transforming-church-bringing-out-the-good-to-get-to-great.pdf
    • http://www.gorillawalker.com/marketing-interior-design-second-edition.pdf
    • http://www.gorillawalker.com/scoring-for-percussion-and-the-instruments-of-the-percussion-section.pdf
    • http://www.gorillawalker.com/the-traditional-artist-in-african-societies-a-midland-book.pdf
    • http://www.gorillawalker.com/the-ditlove-photography-workshop-kindle-edition.pdf
    • http://www.gorillawalker.com/anguished-english-an-anthology-of-accidental-assaults-upon-our-language.pdf
    • http://www.gorillawalker.com/karnali-under-stress-livelihood-strategies-and-seasonal-rhythms-in-a.pdf
    • http://www.gorillawalker.com/nhl-official-guide-record-book.pdf
    • http://www.gorillawalker.com/the-girl-from-purple-mountain-love-honor-war-and-one.pdf
    • http://www.gorillawalker.com/critical-care-ultrasound-manual-1e.pdf
    • http://www.gorillawalker.com/frozen-and-easy-baby-food-why-and-how-the-way.pdf
    • http://www.gorillawalker.com/personal-narrative-of-a-pilgrimage-to-al-madina-volume-2.pdf
    • http://www.gorillawalker.com/leon-battista-alberti-s-hypnerotomachia-poliphili-re-cognizing-the-architectural.pdf
    • http://www.gorillawalker.com/teatime-a-taste-of-london-s-best-afternoon-teas.pdf
    • http://www.gorillawalker.com/sakuntala-texts-readings-histories.pdf
    • http://www.gorillawalker.com/les-quatre-livres-du-courtisan-du-conte-baltazar-de-castillon.pdf
    • http://www.gorillawalker.com/indian-literature-in-english-critical-assessments.pdf
    • http://www.gorillawalker.com/faust-tomes-1-et-2-french-edition.pdf
    • http://www.gorillawalker.com/how-to-survive-anywhere-a-guide-for-urban-suburban-rural.pdf
    • http://www.gorillawalker.com/american-cinema-of-the-1960s-themes-and-variations-screen-decades.pdf
    • http://www.gorillawalker.com/the-expanding-discourse-feminism-and-art-history-icon-editions.pdf
    • http://www.gorillawalker.com/my-baby-s-journal-pink.pdf
    • http://www.gorillawalker.com/personal-narrative-of-a-pilgrimage-to-al-madinah-volume-2.pdf
    • http://www.gorillawalker.com/feminized-husband-a-wife-s-revenge-kindle-edition.pdf
    • http://www.gorillawalker.com/business-reorganization-in-bankruptcy-cases-and-materials-american-casebooks.pdf
    • http://www.gorillawalker.com/umarex-replica-air-guns-1996-2014-4-5mm-steel-bb.pdf
    • http://www.gorillawalker.com/legendary-locals-of-hudson.pdf
    • http://www.gorillawalker.com/compact-first-student-s-book-without-answers-with-cd-rom.pdf
    • http://www.gorillawalker.com/title-40-environment-150-189-2010-title-40-environment.pdf
    • http://www.gorillawalker.com/nicaragua-honduras-el-salvador-adventure-map-by-national-geographic-maps.pdf
    • http://www.gorillawalker.com/building-a-deck-for-beginners.pdf
    • http://www.gorillawalker.com/i-can-do-hard-things-with-god-essays-of-strength.pdf
    • http://www.gorillawalker.com/precious-metal-decibel-presents-the-stories-behind-25-extreme-metal.pdf
    • http://www.gorillawalker.com/shoe-contemporary-footwear-by-inspiring-designers.pdf
    • http://www.gorillawalker.com/ib-environmental-systems-societies-oxford-ib-diploma-program.pdf
    • http://www.gorillawalker.com/brain-games-picture-puzzles-3-how-many-differences-can-you.pdf
    • http://www.gorillawalker.com/marketing-interior-design-second-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.