Malicious PDF — malware analysis report

Static analysis result for SHA-256 42b03647f9964655…

MALICIOUS

PDF

33.4 KB Created: 2020-02-20 04:47:06 +03:00 Authoring application: http://www.helpandmanual.com (via wPDF3 by WPCubed GmbH) First seen: 2021-06-28
MD5: cd7e8436aa77a2d9f726bfdcc9c464fd SHA-1: a224c6b4b604bdcd68c6a9adbd00641eb5afee55 SHA-256: 42b03647f9964655f36d39b5ce01474ff37d4c66050c09bfef2427a317a84064
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The embedded URLs are likely used to manipulate search engine rankings or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/essential-mac-os-x-panther-server-administration-integrating-mac-os.pdf In PDF document text
    • http://www.gorillawalker.com/how-to-solve-word-problems-in-algebra-a-solved-problem.pdfIn PDF document text
    • http://www.gorillawalker.com/jaynie-and-the-alien.pdfIn PDF document text
    • http://www.gorillawalker.com/neonatology-pathophysiology-and-management-of-the-newborn.pdfIn PDF document text
    • http://www.gorillawalker.com/denying-the-holocaust-the-growing-assault-on-truth-and-memory.pdfIn PDF document text
    • http://www.gorillawalker.com/teen-health-course-3-student-activities-workbook.pdfIn PDF document text
    • http://www.gorillawalker.com/2016-planner-too-blessed-to-be-stressed.pdfIn PDF document text
    • http://www.gorillawalker.com/practical-three-way-calibration.pdfIn PDF document text
    • http://www.gorillawalker.com/loving-la-the-low-carbon-way-24-adventures-in-the.pdfIn PDF document text
    • http://www.gorillawalker.com/the-art-of-becoming-homeless-the-greek-village-collection-book.pdfIn PDF document text
    • http://www.gorillawalker.com/box-turtle-at-silver-pond-lane-a-smithsonian-s-backyard.pdfIn PDF document text
    • http://www.gorillawalker.com/temper-tantrum-common-sense-handbook-common-sense-handbooks-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/jerry-es-mejor-spanish-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/the-jet-set-travel-guide-to-florence-italy-2013-kindle.pdfIn PDF document text
    • http://www.gorillawalker.com/video-game-programming-for-kids-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/introduction-to-adiabatic-shear-localization.pdfIn PDF document text
    • http://www.gorillawalker.com/communicator-ii-bk-2.pdfIn PDF document text
    • http://www.gorillawalker.com/heaven-painted-as-a-christmas-gift-volume-2.pdfIn PDF document text
    • http://www.gorillawalker.com/measurement-and-probability-a-probabilistic-theory-of-measurement-with-applications.pdfIn PDF document text
    • http://www.gorillawalker.com/no-rules-brazilian-jiu-jitsu-techniques-for-mixed-martial-arts.pdfIn PDF document text
    • http://www.gorillawalker.com/educational-leaflets-issued-by-the-mutual-life-insurance-company-of.pdfIn PDF document text
    • http://www.gorillawalker.com/freeing-tibet-50-years-of-struggle-resilience-and-hope.pdfIn PDF document text
    • http://www.gorillawalker.com/shattered-dreams-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/blood-moon-god-s-warning-jewish-feasts-and-the-blood.pdfIn PDF document text
    • http://www.gorillawalker.com/the-art-and-business-of-photography.pdfIn PDF document text
    • http://www.gorillawalker.com/blue-light-can-detect-microscopic-endometriosis-laparoscopic-spectral-analysis-an.pdfIn PDF document text
    • http://www.gorillawalker.com/the-meaning-of-good-a-dialogue.pdfIn PDF document text
    • http://www.gorillawalker.com/labour-law-in-the-netherlands.pdfIn PDF document text
    • http://www.gorillawalker.com/henrik-ibsen-doll-s-house-notes-york-notes.pdfIn PDF document text
    • http://www.gorillawalker.com/midlife-crisis-in-morocco-travels-on-a-whim-and-a.pdfIn PDF document text
    • http://www.gorillawalker.com/murder-on-the-champ-de-mars-an-aim.pdfIn PDF document text
    • http://www.gorillawalker.com/the-land-of-open-graves-living-and-dying-on-the.pdfIn PDF document text
    • http://www.gorillawalker.com/boom-and-bust-financial-cycles-and-human-prosperity-values-and.pdfIn PDF document text
    • http://www.gorillawalker.com/supercoach.pdfIn PDF document text
    • http://www.gorillawalker.com/water-pollution-microbiology-v-2.pdfIn PDF document text
    • http://www.gorillawalker.com/gettysburg-battle-of-an-entry-from-charles-scribner-s-sons.pdfIn PDF document text
    • http://www.gorillawalker.com/wizard-s-brew-camelot-wizards-volume-1.pdfIn PDF document text
    • http://www.gorillawalker.com/12-romances-op-14-spring-waters-no-11-for-orchestra.pdfIn PDF document text
    • http://www.gorillawalker.com/don-t-send-me-flowers-when-i-m-dead-voices.pdfIn PDF document text
    • http://www.gorillawalker.com/small-animal-internal-medicine-4e-small-animal-medicine.pdfIn PDF document text
    • http://www.helpandmanual.comIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.