Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f98de9038cc2c6b…

MALICIOUS

PDF

43.3 KB Created: 2018-12-15 20:07:32 +03:00 Authoring application: ESP Ghostscript 815.02
MD5: 52c14fd076690db86b0834b406776d02 SHA-1: 02bfcddc0ee200df28c202318f1277f641091633 SHA-256: 3f98de9038cc2c6b48fe5df6b65e41279e8f2bbcdf8169b7137b57919f2ffff4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by a machine learning classifier as malicious and contains a large number of external links, a technique often used for SEO manipulation or to host malicious content. The embedded URLs suggest a link farm or redirection scheme. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9016

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/plants-for-dry-climates-how-to-select-grow-enjoy.pdf
    • http://www.gorillawalker.com/the-gourmet-soup-book.pdf
    • http://www.gorillawalker.com/street-wars-gangs-and-the-future-of-violence.pdf
    • http://www.gorillawalker.com/the-adventures-of-buckaroo-banzai.pdf
    • http://www.gorillawalker.com/post-traumatic-stress-disorder-the-invisible-injury.pdf
    • http://www.gorillawalker.com/abused-love.pdf
    • http://www.gorillawalker.com/nearly-normal-cooking-for-gluten-free-eating-a-fresh-approach.pdf
    • http://www.gorillawalker.com/la-dama-azul-el-vaticano-nunca-conto-toda-la-verdad.pdf
    • http://www.gorillawalker.com/carlos-diez-sketchbook.pdf
    • http://www.gorillawalker.com/if-i-were-starting-my-family-again-revised.pdf
    • http://www.gorillawalker.com/a-malibu-mom-s-manifesto-on-fresh-whole-foods-simple.pdf
    • http://www.gorillawalker.com/modulations-a-history-of-electronic-music-throbbing-words-on-sound.pdf
    • http://www.gorillawalker.com/milking-the-secretary-lesbian-lactation-erotica.pdf
    • http://www.gorillawalker.com/ravel-gaspard-de-la-nuit-alfred-masterwork-editions-kindle-edition.pdf
    • http://www.gorillawalker.com/significant-changes-to-the-wind-load-provisions-of-asce-7.pdf
    • http://www.gorillawalker.com/100-jazz-lessons-guitar-lesson-goldmine-series-book-cd.pdf
    • http://www.gorillawalker.com/straight-from-the-horse-s-mouth-how-to-talk-to.pdf
    • http://www.gorillawalker.com/150-problemas-de-matem-ticas-para-primero-de-primaria-tomo.pdf
    • http://www.gorillawalker.com/strange-bodies-gender-and-identity-in-the-novels-of-carson.pdf
    • http://www.gorillawalker.com/final-fantasy-iii-player-s-guide.pdf
    • http://www.gorillawalker.com/marine-engineering-practice-a-manual-on-the-design-construction-operation.pdf
    • http://www.gorillawalker.com/contacts-langue-et-culture-franaises-8th-edition-world-languages-program.pdf
    • http://www.gorillawalker.com/introducing-lickablewords-peep-show-with-vvv-kindle-edition.pdf
    • http://www.gorillawalker.com/microimplants-in-orthodontics.pdf
    • http://www.gorillawalker.com/how-children-succeed-grit-curiosity-and-the-hidden-power-of.pdf
    • http://www.gorillawalker.com/in-the-hall-of-the-mountain-king-sheet-simply-classics.pdf
    • http://www.gorillawalker.com/what-was-cooking-in-martha-washington-s-presidential-mansions-cooking.pdf
    • http://www.gorillawalker.com/ketogenic-diets-treatments-for-epilepsy-and-other-disorders-a-treatment.pdf
    • http://www.gorillawalker.com/ingrid-michaelson-strum-sing-guitar.pdf
    • http://www.gorillawalker.com/holt-algebra-1-california-review-for-mastery-workbook-algebra-1.pdf
    • http://www.gorillawalker.com/myths-of-creation.pdf
    • http://www.gorillawalker.com/the-kill-order-maze-runner-series.pdf
    • http://www.gorillawalker.com/story-of-jacksonville.pdf
    • http://www.gorillawalker.com/sampling-techniques-2nd-edition.pdf
    • http://www.gorillawalker.com/mozart-19-sonatas-complete-piano-solo.pdf
    • http://www.gorillawalker.com/the-origin-of-species-revised-edition.pdf
    • http://www.gorillawalker.com/cuckolded-taken-by-my-husband-s-bully-taboo-interracial-cuckold.pdf
    • http://www.gorillawalker.com/the-annotated-waste-land-with-eliot-146-s-contemporary-prose.pdf
    • http://www.gorillawalker.com/the-adventure-of-the-boxing-day-murder-plus-some-holmesian.pdf
    • http://www.gorillawalker.com/500-bowls-contemporary-explorations-of-a-timeless-design.pdf
    • http://www.gorillawalker.com/if-i-were-s
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.