Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fb051307a956740…

MALICIOUS

PDF

44.5 KB Created: 2019-02-13 20:36:44 +03:00 Authoring application: Adobe InDesign CS6 (Macintosh) (via 3-Heights(TM) PDF Optimization Shell 4.6.23.0 (http://www.pdf-tools.com))
MD5: faffe3c1f52943ecf0f4ad23417c3582 SHA-1: 23befa769336fa71c756b9521672348fcad28380 SHA-256: 3fb051307a9567408e6ae178b7858baa6f502a7dcf0feb5a4b64492d41ee00e3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a link farm or a distribution point for further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9007

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/montana-before-history.pdf
    • http://www.gorillawalker.com/the-assassination-of-new-york.pdf
    • http://www.gorillawalker.com/minefill-2001-proceedings-of-the-7th-international-symposium-on-mining.pdf
    • http://www.gorillawalker.com/dysphagia-diagnosis-and-management.pdf
    • http://www.gorillawalker.com/natural-solutions-for-food-allergies-and-food-intolerances-scientifically-proven.pdf
    • http://www.gorillawalker.com/kefalonia-greece.pdf
    • http://www.gorillawalker.com/tabo-monastery-and-buddhism-in-the-trans-himalayas-1000-years.pdf
    • http://www.gorillawalker.com/jonah-and-the-very-big-fish-arch-books.pdf
    • http://www.gorillawalker.com/true-world-history-humanity-s-saga-kindle-edition.pdf
    • http://www.gorillawalker.com/the-school-portfolio-a-comprehensive-framework-for-school-management.pdf
    • http://www.gorillawalker.com/28-italian-songs-arias-of-the-17th-18th-centuries-medium.pdf
    • http://www.gorillawalker.com/the-voter-s-dilemma-and-democratic-accountability-latin-american-and.pdf
    • http://www.gorillawalker.com/an-introduction-to-fish-parasitological-methods-classical-and-molecular-techniques.pdf
    • http://www.gorillawalker.com/sailors-sailors.pdf
    • http://www.gorillawalker.com/travels-in-languedoc-secrets-to-a-memorable-visit.pdf
    • http://www.gorillawalker.com/the-nile-without-a-dragoman-cambridge-library-collection-travel-middle.pdf
    • http://www.gorillawalker.com/taiwan-flowers-map-traditional-chinese-edition.pdf
    • http://www.gorillawalker.com/oxford-textbook-of-vertigo-and-imbalance-oxford-textbooks-in-clinical.pdf
    • http://www.gorillawalker.com/heal-your-body-the-mental-causes-for-physical-illness-and.pdf
    • http://www.gorillawalker.com/it-is-well-with-my-soul-handbell-sheet-music-handbell.pdf
    • http://www.gorillawalker.com/lombricoltura-para-principiantes-empezar-tu-propia-lombricoltura-y-hacer-tu.pdf
    • http://www.gorillawalker.com/my-benjamin-bunny-notebook.pdf
    • http://www.gorillawalker.com/75-readings-an-anthology.pdf
    • http://www.gorillawalker.com/a-summer-in-maine.pdf
    • http://www.gorillawalker.com/the-organized-teacher-s-guide-to-classroom-management-with-cd.pdf
    • http://www.gorillawalker.com/autumn-poems-songs-prayers-weather-windows.pdf
    • http://www.gorillawalker.com/people-apart-1950s-cape-town-revisited-photographs-by-bryan-heseltine.pdf
    • http://www.gorillawalker.com/a-morning-cup-of-balance-the-morning-cup-series.pdf
    • http://www.gorillawalker.com/at-risk-youth-an-annotated-bibliography-for-migrant-educators.pdf
    • http://www.gorillawalker.com/molecular-mechanics-acs-monograph.pdf
    • http://www.gorillawalker.com/citizenship-the-self-and-the-other-critical-discussions-on-citizenship.pdf
    • http://www.gorillawalker.com/spectrum-geography-grade-4-regions-of-the-u-s-a.pdf
    • http://www.gorillawalker.com/snakes-of-virginia.pdf
    • http://www.gorillawalker.com/strength-training-for-rugby.pdf
    • http://www.gorillawalker.com/autodesk-inventor-2013-for-designers.pdf
    • http://www.gorillawalker.com/modern-woodworking-tools-materials-and-processes.pdf
    • http://www.gorillawalker.com/eating-fractions.pdf
    • http://www.gorillawalker.com/basic-bioinformatics.pdf
    • http://www.gorillawalker.com/more-allegheny-episodes-legends-and-traditions-old-and-new-gathered.pdf
    • http://www.gorillawalker.com/travel-journal-ghana.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://www.pdf-tools.com
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.