Malicious PDF — malware analysis report

Static analysis result for SHA-256 44fbb2d7d4e26bf7…

MALICIOUS

PDF

38.9 KB Created: 2019-03-17 17:23:28 +03:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.4) First seen: 2021-06-28
MD5: 274547b6b00dc3adff0756514a02fbaa SHA-1: c48d58659515af0292fbf361a6e7ff6e5a2cc996 SHA-256: 44fbb2d7d4e26bf7c6ce63196be0acdc86d78835fbc07ada56b596c3eb016800
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, identified by the PDF_SEO_LINK_FARM heuristic. While no scripts were explicitly extracted, the ML classifier flagged the PDF as malicious. The embedded URLs suggest an attempt to manipulate search engine results or distribute a large volume of content, potentially malicious, to unsuspecting users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8901

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/encyclopedia-of-deception.pdf In PDF document text
    • http://www.gorillawalker.com/how-to-win-in-a-volatile-stock-market-the-definitive.pdfIn PDF document text
    • http://www.gorillawalker.com/basic-college-mathematics-7th-edition-tobey-slater-blair-developmental-mathematics.pdfIn PDF document text
    • http://www.gorillawalker.com/galapagos-a-natural-history-guide-seventh-edition-odyssey-illustrated-guides.pdfIn PDF document text
    • http://www.gorillawalker.com/consolidation-of-municipalities-and-autonomous-regions-decentralization-2001-isbn-4872992741.pdfIn PDF document text
    • http://www.gorillawalker.com/nathaniel-talking.pdfIn PDF document text
    • http://www.gorillawalker.com/chile-argentina-mapa-national-788.pdfIn PDF document text
    • http://www.gorillawalker.com/alexa-legionnaire-training-an-assassin-prequel-to-alexa-the-series.pdfIn PDF document text
    • http://www.gorillawalker.com/the-divine-order-of-faith-how-to-get-from-the.pdfIn PDF document text
    • http://www.gorillawalker.com/light-and-heavy-vehicle-technology.pdfIn PDF document text
    • http://www.gorillawalker.com/the-bible-dictionary-meanings-of-names-and-words-in-the.pdfIn PDF document text
    • http://www.gorillawalker.com/a-handbook-of-global-freshwater-invasive-species.pdfIn PDF document text
    • http://www.gorillawalker.com/compstat-2008-proceedings-in-computational-statistics.pdfIn PDF document text
    • http://www.gorillawalker.com/andalucia-aa-essential-guide.pdfIn PDF document text
    • http://www.gorillawalker.com/colloquial-russian-the-complete-course-for-beginners-colloquial-series-kindle.pdfIn PDF document text
    • http://www.gorillawalker.com/the-complete-short-prose-of-samuel-beckett-1929-1989.pdfIn PDF document text
    • http://www.gorillawalker.com/traditional-folk-song-in-modern-japan-sources-sentiment-and-society.pdfIn PDF document text
    • http://www.gorillawalker.com/the-world-of-your-dreams.pdfIn PDF document text
    • http://www.gorillawalker.com/salisbury-cathedral.pdfIn PDF document text
    • http://www.gorillawalker.com/witch-winnie-in-venice-and-the-alchemist-s-story.pdfIn PDF document text
    • http://www.gorillawalker.com/history-of-rap-music-aaa-african-american-achievers.pdfIn PDF document text
    • http://www.gorillawalker.com/treasure-a-magical-mysterious-brain-teasing-quest-through-middle-england.pdfIn PDF document text
    • http://www.gorillawalker.com/the-victorian-novel-oxford-history-of-english-literature.pdfIn PDF document text
    • http://www.gorillawalker.com/magia-cristica-azteca-spanish-edition-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/blimpo-the-third-circle-of-heck.pdfIn PDF document text
    • http://www.gorillawalker.com/access-to-the-arts-for-people-with-communication-disability.pdfIn PDF document text
    • http://www.gorillawalker.com/askari-a-story-of-collaboration-and-betrayal-in-the-anti.pdfIn PDF document text
    • http://www.gorillawalker.com/erasing-shadows-book-1.pdfIn PDF document text
    • http://www.gorillawalker.com/global-warming-essential-viewpoints.pdfIn PDF document text
    • http://www.gorillawalker.com/the-colony-book-one-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/i-saw-him-in-your-eyes.pdfIn PDF document text
    • http://www.gorillawalker.com/rabbit-habits.pdfIn PDF document text
    • http://www.gorillawalker.com/solar-system-earth-science-in-action-ser.pdfIn PDF document text
    • http://www.gorillawalker.com/the-pegan-diet-25-delicious-recipes-for-the-paleo-vegan.pdfIn PDF document text
    • http://www.gorillawalker.com/electrochemical-impedance-analysis-and-interpretation-astm-special-technical-publication-stp.pdfIn PDF document text
    • http://www.gorillawalker.com/killing-britney.pdfIn PDF document text
    • http://www.gorillawalker.com/snooker-sportsviewers-guides.pdfIn PDF document text
    • http://www.gorillawalker.com/citizen-you-doing-your-part-to-change-the-world.pdfIn PDF document text
    • http://www.gorillawalker.com/here-i-stand.pdfIn PDF document text
    • http://www.gorillawalker.com/tales-from-the-red-couch.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.