Malicious PDF — malware analysis report

Static analysis result for SHA-256 4017032002536975…

MALICIOUS

PDF

43.4 KB Created: 2019-04-04 09:15:14 +03:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 6.0 (Windows))
MD5: f339c5675dbc51e4f3da080b704300a0 SHA-1: b20fa45eae6e8e7df7e8f8688e5a9b1544967069 SHA-256: 4017032002536975d199892ffce82749afb4b2012e62723abb69b3bf3ce67277
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The document body is heavily obfuscated and unreadable, but the presence of numerous links suggests a content-farming or redirection scheme, potentially leading to malicious sites or further malware downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9016

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/100-british-documentaries-screen-guides.pdf
    • http://www.gorillawalker.com/in-his-own-words-in-their-own-words-bbc-audio.pdf
    • http://www.gorillawalker.com/the-jeep-history-of-a-world-war-ii-legend.pdf
    • http://www.gorillawalker.com/studies-on-aerosols.pdf
    • http://www.gorillawalker.com/the-armlock-encyclopedia-85-armlocks-for-jujitsu-judo-sambo-and.pdf
    • http://www.gorillawalker.com/tip-the-mouse-can-t-sleep.pdf
    • http://www.gorillawalker.com/brutally-honest-fast-food-reviews-the-best-and-worst-of.pdf
    • http://www.gorillawalker.com/smithsonian-answer-book-cats.pdf
    • http://www.gorillawalker.com/jeux-de-vacances-pour-enfants-charades-devinettes-blagues-et-lectures.pdf
    • http://www.gorillawalker.com/pose-da-volumen-4-spanish-edition.pdf
    • http://www.gorillawalker.com/voice-leading-for-guitar-moving-through-the-changes.pdf
    • http://www.gorillawalker.com/scientific-romances.pdf
    • http://www.gorillawalker.com/astronomical-tidbits-a-layperson-s-guide-to-astronomy.pdf
    • http://www.gorillawalker.com/valiant-women-in-war-and-exile-thirty-eight-true-stories.pdf
    • http://www.gorillawalker.com/poems-written-in-silence-surviving-reality-through-poetry-kindle-edition.pdf
    • http://www.gorillawalker.com/forced-into-glory-abraham-lincoln-s-white-dream.pdf
    • http://www.gorillawalker.com/b-is-for-beaver-an-oregon-alphabet-alphabet-series.pdf
    • http://www.gorillawalker.com/the-basic-baby-food-cookbook-complete-beginner-guide-to-making.pdf
    • http://www.gorillawalker.com/religion-and-the-american-civil-war.pdf
    • http://www.gorillawalker.com/aad-munich-english-and-german-edition.pdf
    • http://www.gorillawalker.com/ellyphant-elly-kent-book-1.pdf
    • http://www.gorillawalker.com/higher-finance-how-to-live-debt-free.pdf
    • http://www.gorillawalker.com/hillary-rodham-clinton-on-the-couch-inside-the-mind-and.pdf
    • http://www.gorillawalker.com/how-elevation-of-corporate-free-speech-rights-affects-legality-of.pdf
    • http://www.gorillawalker.com/by-hansen-2015-quilt-art-engagement-calendar-1st-edition.pdf
    • http://www.gorillawalker.com/animating-film-theory.pdf
    • http://www.gorillawalker.com/responding-to-emergency-american-red-cross.pdf
    • http://www.gorillawalker.com/the-films-of-oshima-nagisa-images-of-a-japanese-iconoclast.pdf
    • http://www.gorillawalker.com/the-unbelievable-truth-powerful-insights-into-the-unseen-world-of.pdf
    • http://www.gorillawalker.com/a-view-of-the-sea-a-discussion-between-a-chief.pdf
    • http://www.gorillawalker.com/why-doesn-t-god-answer-me-trusting-in-times-of.pdf
    • http://www.gorillawalker.com/today-i-show-dinosaur-pictures-for-kids-children-s-picture.pdf
    • http://www.gorillawalker.com/procrastinator-s-sos-planner-2008-desk-calendar.pdf
    • http://www.gorillawalker.com/cruising-in-tropical-waters-and-coral.pdf
    • http://www.gorillawalker.com/bocca-cookbook.pdf
    • http://www.gorillawalker.com/one-fourteenth-of-an-elephant.pdf
    • http://www.gorillawalker.com/the-paul-michael-weight-loss-plan-how-you-can-lose.pdf
    • http://www.gorillawalker.com/construction-codes-inspection-handbook.pdf
    • http://www.gorillawalker.com/running-for-the-hills-a-family-story.pdf
    • http://www.gorillawalker.com/becoming-a-nursing-assistant-enjoy-the-extensive-rewards-of-a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.