Malicious PDF — malware analysis report

Static analysis result for SHA-256 471b75cfd1ff2247…

MALICIOUS

PDF

34.0 KB Created: 2020-02-08 18:23:07 +03:00 Authoring application: TopLeaf 7.6.056 (via iText 2.1.7 by 1T3XT) First seen: 2021-06-28
MD5: 1815a94617e7870cb8f437bf90aefd6a SHA-1: 0af98c8dca844a515a5f752f45929cb02b86d979 SHA-256: 471b75cfd1ff224733b98230c46dac1428b896bdb06efbb92835d189a0d788af
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. These links all point to the same domain, suggesting a coordinated effort to manipulate search engine results or distribute potentially malicious content. No scripts were extracted from this sample, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/motorcycle-fuel-systems-techbook.pdf In PDF document text
    • http://www.gorillawalker.com/the-big-book-of-six-sigma-training-games-proven-ways.pdfIn PDF document text
    • http://www.gorillawalker.com/travels-through-the-interior-provinces-of-colombia-volume-2.pdfIn PDF document text
    • http://www.gorillawalker.com/an-atlas-of-small-parts-and-musculoskeletal-ultrasound-with-color.pdfIn PDF document text
    • http://www.gorillawalker.com/hikes-around-invermere-the-columbia-river-valley.pdfIn PDF document text
    • http://www.gorillawalker.com/staffing-management-and-methods-tools-and-techniques-for-nurse-leaders.pdfIn PDF document text
    • http://www.gorillawalker.com/the-message-bible-complete-the-bible-in-contemporary-language.pdfIn PDF document text
    • http://www.gorillawalker.com/brasses-and-brass-rubbing.pdfIn PDF document text
    • http://www.gorillawalker.com/the-makeover-in-movies-before-and-after-in-hollywood-films.pdfIn PDF document text
    • http://www.gorillawalker.com/in-conversation-with-god-meditations-for-each-day-of-the.pdfIn PDF document text
    • http://www.gorillawalker.com/the-2009-2014-world-outlook-for-aerospace-type-hydraulic-and.pdfIn PDF document text
    • http://www.gorillawalker.com/darkest-waters-notorious-usa.pdfIn PDF document text
    • http://www.gorillawalker.com/alphabet-book-farmyard-tales-books-series.pdfIn PDF document text
    • http://www.gorillawalker.com/family-tree-ace.pdfIn PDF document text
    • http://www.gorillawalker.com/doctor-who-series-3-volume-4-dead-man-s-hand.pdfIn PDF document text
    • http://www.gorillawalker.com/the-bible-exposition-commentary-old-testament-the-pentateuch.pdfIn PDF document text
    • http://www.gorillawalker.com/landscapes-of-urban-memory-the-sacred-and-the-civic-in.pdfIn PDF document text
    • http://www.gorillawalker.com/moon-spotlight-columbia-river-gorge.pdfIn PDF document text
    • http://www.gorillawalker.com/woman-in-the-nineteenth-century-an-entry-from-charles-scribner.pdfIn PDF document text
    • http://www.gorillawalker.com/subarachnoid-haemorrhage.pdfIn PDF document text
    • http://www.gorillawalker.com/57.pdfIn PDF document text
    • http://www.gorillawalker.com/disclosing-new-worlds-entrepreneurship-democratic-action-and-the-cultivation-of.pdfIn PDF document text
    • http://www.gorillawalker.com/his-first-love-true-nevada-hearts-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/2001-02-miller-local-government-audits.pdfIn PDF document text
    • http://www.gorillawalker.com/ted-talks-learn-the-public-speaking-and-presentation-skills-you.pdfIn PDF document text
    • http://www.gorillawalker.com/the-elegant-self-a-radical-approach-to-personal-evolution-for.pdfIn PDF document text
    • http://www.gorillawalker.com/it-s-your-ship-management-techniques-from-the-best-damn.pdfIn PDF document text
    • http://www.gorillawalker.com/what-great-teachers-do-differently-17-things-that-matter-most.pdfIn PDF document text
    • http://www.gorillawalker.com/in-praise-of-grandmothers.pdfIn PDF document text
    • http://www.gorillawalker.com/grey-citadel-d20-generic-system.pdfIn PDF document text
    • http://www.gorillawalker.com/tchaikovsky-18-piano-pieces-op-72-music-scores.pdfIn PDF document text
    • http://www.gorillawalker.com/the-attorney-s-handbook-on-small-business-reorganization-under-chapter.pdfIn PDF document text
    • http://www.gorillawalker.com/silks-for-thrones-and-altars-chinese-costumes-and-textiles.pdfIn PDF document text
    • http://www.gorillawalker.com/emergency-medical-services-systems-development-lessons-learned-from-the-united.pdfIn PDF document text
    • http://www.gorillawalker.com/basic-pathology-fifth-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/the-eunuch-neferu.pdfIn PDF document text
    • http://www.gorillawalker.com/chinese-archery.pdfIn PDF document text
    • http://www.gorillawalker.com/psychology-applied-to-modern-life-adjustment-in-the-21st-century.pdfIn PDF document text
    • http://www.gorillawalker.com/demographic-and-behavioral-aspects-of-population-movement-with-relevance-to.pdfIn PDF document text
    • http://www.gorillawalker.com/the-rule-of-saint-benedict-initiation-into-the-monastic-tradition.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.