Malicious PDF — malware analysis report

Static analysis result for SHA-256 45cc474ebbd2d321…

MALICIOUS

PDF

44.4 KB Created: 2018-12-15 20:18:29 +03:00 Authoring application: PrimoPDF http://www.primopdf.com/ (via PrimoPDF)
MD5: 0a6402d9447aa656322654c5611560bc SHA-1: df8efddecf604c148354b609d52076de29ce0d04 SHA-256: 45cc474ebbd2d32182a15feef3aec78a6c559bbb3b7d61a4e59dee8608e6aa3d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains a large number of embedded URLs, indicating a link farm or a distribution point for other malicious content. The primary heuristic identified a "PDF_SEO_LINK_FARM" with 32 external links, suggesting the document's purpose is to manipulate search engine rankings or to serve as a lure for users to click on these links. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/body-art-nature.pdf
    • http://www.gorillawalker.com/duos-classiques-pour-le-violon-alto-pi-ces-faciles-de.pdf
    • http://www.gorillawalker.com/return-to-the-crease-kindle-edition.pdf
    • http://www.gorillawalker.com/spanish-for-nurses-essential-power-words-and-phrases-for-workplace.pdf
    • http://www.gorillawalker.com/out-of-this-world-northern-ireland-voices.pdf
    • http://www.gorillawalker.com/walks-and-talks-in-numberland.pdf
    • http://www.gorillawalker.com/the-mechanic-s-tale-life-in-the-pit-lanes-of.pdf
    • http://www.gorillawalker.com/the-homework-myth-why-our-kids-get-too-much-of.pdf
    • http://www.gorillawalker.com/making-of-laloo-yadav-the-unmaking-of-bihar.pdf
    • http://www.gorillawalker.com/last-chance-show-jumping-dreams-book-6-kindle-edition.pdf
    • http://www.gorillawalker.com/out-of-stone.pdf
    • http://www.gorillawalker.com/mary-stewart-twayne-s-english-authors-series.pdf
    • http://www.gorillawalker.com/creative-careers-in-photography-making-a-living-with-or-without.pdf
    • http://www.gorillawalker.com/catalogue-of-the-hebrew-manuscripts-preserved-in-the-university-library.pdf
    • http://www.gorillawalker.com/sudan-a-novel-kindle-edition.pdf
    • http://www.gorillawalker.com/a-renegade-history-of-the-united-states-unabridged-audible-audio.pdf
    • http://www.gorillawalker.com/the-discovery-of-the-americas-activities-book.pdf
    • http://www.gorillawalker.com/structural-geology-principles-concepts-and-problems.pdf
    • http://www.gorillawalker.com/thaddeus-william-harris-1795-1856-nature-science-and-society-in.pdf
    • http://www.gorillawalker.com/teaching-children-with-visual-impairment-children-with-special-needs-series.pdf
    • http://www.gorillawalker.com/kwanzaa-a-celebration-of-family-community-and-culture-commemorative.pdf
    • http://www.gorillawalker.com/the-late-great-lakes-an-environmental-history-great-lakes-books.pdf
    • http://www.gorillawalker.com/bacchylides-a-selection-cambridge-greek-and-latin-classics.pdf
    • http://www.gorillawalker.com/darkness-visible-a-study-of-vergil-s-aeneid.pdf
    • http://www.gorillawalker.com/gm-x-body-1980-85-chilton-s-repair-tune-up.pdf
    • http://www.gorillawalker.com/honduras-literaria-coleccion-de-escritos-en-prosa-y-verso-precedidos.pdf
    • http://www.gorillawalker.com/nature-of-snowboarding-eyte-to-eye.pdf
    • http://www.gorillawalker.com/the-accurate-router-quick-setups-and-simple-jigs-cambium-handbook.pdf
    • http://www.gorillawalker.com/valency-and-bonding-a-natural-bond-orbital-donor-acceptor-perspective.pdf
    • http://www.gorillawalker.com/the-thunderbird-project.pdf
    • http://www.gorillawalker.com/the-life-writings-and-character-of-edward-robinson-america-and.pdf
    • http://www.gorillawalker.com/minnesota-celebrate-the-states.pdf
    • http://www.gorillawalker.com/the-body-betrayed-a-deeper-understanding-of-women-eating-disorders.pdf
    • http://www.gorillawalker.com/building-systems-question-and-answer-2009.pdf
    • http://www.gorillawalker.com/comprehensive-gynecology-review-4e.pdf
    • http://www.gorillawalker.com/ownership-economics-on-the-foundations-of-interest-money-markets-business.pdf
    • http://www.gorillawalker.com/how-to-write-present-technical-information.pdf
    • http://www.gorillawalker.com/napoleon-s-glance-the-secret-of-strategy-nation-books.pdf
    • http://www.gorillawalker.com/vox-diccionario-esencial-de-sinonimos-y-antonimos-lengua-espanola-vox.pdf
    • http://www.gorillawalker.com/welcome-to-lizard-motel-protecting-the-imaginative-lives-of-children.pdf
    • http://www.primopdf.com/
    • http://www.gorillawalker.com/out-of-this-world-northern-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.