Malicious PDF — malware analysis report

Static analysis result for SHA-256 412d26fd3d98e14c…

MALICIOUS

PDF

46.3 KB Created: 2019-04-04 15:06:53 +03:00 Authoring application: - (via Acrobat Distiller 15.0 (Windows))
MD5: 3173561e3ee3335cf0276757ab6d2efb SHA-1: 6f55d4d66d9b832a30549e240ec8093d5f340cfe SHA-256: 412d26fd3d98e14c164a693bbdda8128c23d21cbc65d4d9eabd323a77a83fa0a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to documents on the same domain, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a link-farming or content-luring scheme. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious classification. No scripts were extracted, and the document body was unreadable, so the primary attack pattern is inferred from the link structure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8709

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/embryology.pdf
    • http://www.gorillawalker.com/community-conversation-guide-starting-well-in-your-small-group.pdf
    • http://www.gorillawalker.com/design-of-digital-systems-principles-and-applications.pdf
    • http://www.gorillawalker.com/modern-scandinavian-literature-african-latin-american-and-other-european-literature.pdf
    • http://www.gorillawalker.com/an-ayyubid-notable-and-his-world-ibn-al-adim-and.pdf
    • http://www.gorillawalker.com/nucleon-hadron-many-body-systems-from-hadron-meson-to-quark.pdf
    • http://www.gorillawalker.com/bible-study-tools-21-life-lessons-anyone-can-learn-from.pdf
    • http://www.gorillawalker.com/how-professionals-make-decisions-expertise-research-and-applications-series.pdf
    • http://www.gorillawalker.com/gender-swap-college-spring-break-feminization-gender-transformation-gender-bending.pdf
    • http://www.gorillawalker.com/common-surgical-diseases-an-algorithmic-approach-to-problem-solving.pdf
    • http://www.gorillawalker.com/compromised-inside-slowpocalypse-book-3.pdf
    • http://www.gorillawalker.com/astrological-psychology-western-esotericism-and-the-transpersonal.pdf
    • http://www.gorillawalker.com/social-studies-teaching-activities-books-an-annotated-resource-guide.pdf
    • http://www.gorillawalker.com/great-places-to-stay-in-europe-dk-eyewitness-travel-guide.pdf
    • http://www.gorillawalker.com/mcsweeney-s-issue-28-mcsweeney-s-quarterly-concern.pdf
    • http://www.gorillawalker.com/unthinkable-sins.pdf
    • http://www.gorillawalker.com/choreography-a-basic-approach-using-improvisation-3rd-edition-pb-2007.pdf
    • http://www.gorillawalker.com/25-bicycle-tours-in-the-twin-cities-southeastern-minnesota-25.pdf
    • http://www.gorillawalker.com/international-construction-costs-and-reference-data-yearbook.pdf
    • http://www.gorillawalker.com/droid-x-for-dummies-kindle-edition.pdf
    • http://www.gorillawalker.com/ozark-whitewater.pdf
    • http://www.gorillawalker.com/psychopaths-sociopaths-and-narcissists-defend-yourself-and-break-free-learn.pdf
    • http://www.gorillawalker.com/advanced-ceramic-coatings-and-interfaces-ceramic-engineering-and-science-proceedings.pdf
    • http://www.gorillawalker.com/greater-the-expectations-greater-the-achievements-a-guide-on-using.pdf
    • http://www.gorillawalker.com/high-temperature-coatings-proceedings.pdf
    • http://www.gorillawalker.com/bates-nursing-guide-to-physical-examination-and-history-taking-student.pdf
    • http://www.gorillawalker.com/the-annual-report-of-the-connecticut-historical-society-volume-4.pdf
    • http://www.gorillawalker.com/the-magical-battle-of-britain.pdf
    • http://www.gorillawalker.com/eels-physiology-habitat-and-conservation-marine-biology.pdf
    • http://www.gorillawalker.com/the-qfd-handbook.pdf
    • http://www.gorillawalker.com/more-of-the-easy-60s-fake-book.pdf
    • http://www.gorillawalker.com/constraints-and-opportunities-of-leadership-in-post-communist-europe.pdf
    • http://www.gorillawalker.com/drum-studies-concepts-reading-phrasing-and-technique.pdf
    • http://www.gorillawalker.com/bridge-cardplay-made-easy-a-textbook-for-bridge-classes.pdf
    • http://www.gorillawalker.com/friends-without-benefits-stonehill-romance-book-2.pdf
    • http://www.gorillawalker.com/body-training-30-minute-full-body-workout-for-ultimate-fitness.pdf
    • http://www.gorillawalker.com/the-oxford-children-s-encyclopedia-of-science-and-technology-oxford.pdf
    • http://www.gorillawalker.com/interior-design-theory-and-process.pdf
    • http://www.gorillawalker.com/knowledge-of-higher-worlds-rudolf-steiner-s-blackboard-drawings.pdf
    • http://www.gorillawalker.com/husband-likes-to-film-dirty-wife-s-adventures-other-erotic.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.