Malicious PDF — malware analysis report

Static analysis result for SHA-256 47e11bac553d02e1…

MALICIOUS

PDF

43.6 KB Created: 2018-11-23 08:00:33 +03:00 Authoring application: Adobe Illustrator CS2 (via Adobe PDF library 7.77)
MD5: 2e76ff333286da2167303ec5171f694b SHA-1: 7ee052a1d92c3855c1380e38f586058ecfd26875 SHA-256: 47e11bac553d02e1ec2d3f28dd9f6b267e42d6125f7dd908a0880cecb21de3bf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The primary attack pattern appears to be the distribution of a large number of links, potentially for SEO manipulation or to serve as a lure for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/nine-day-novel-authorphobia-laugh-at-your-fear-of-writing.pdf
    • http://www.gorillawalker.com/stein-on-writing-a-master-editor-shares-his-craft-techniques.pdf
    • http://www.gorillawalker.com/beyond-diversity-day-a-q-a-on-gay-and-lesbian.pdf
    • http://www.gorillawalker.com/rigby-pm-platinum-collection-individual-student-edition-red-levels-3.pdf
    • http://www.gorillawalker.com/building-facades-faces-figures-and-ornamental-details.pdf
    • http://www.gorillawalker.com/the-minimal-self-psychic-survival-in-troubled-times.pdf
    • http://www.gorillawalker.com/from-the-four-chambered-heart-in-tribute-to-anais-nin.pdf
    • http://www.gorillawalker.com/thalberg-life-and-legend.pdf
    • http://www.gorillawalker.com/neuroanatomical-notations.pdf
    • http://www.gorillawalker.com/provence-and-cote-d-azur-eyewitness-travel-guides.pdf
    • http://www.gorillawalker.com/successful-federal-appeals-in-all-circuit-courts-a-practical-guide.pdf
    • http://www.gorillawalker.com/research-methods-for-social-work-sw-385r-social-work-research.pdf
    • http://www.gorillawalker.com/protecting-library-staff-users-collections-and-facilities-a-how-to.pdf
    • http://www.gorillawalker.com/chicago-movie-vocal-selections.pdf
    • http://www.gorillawalker.com/superconductivity-in-two-volumes-volume-1-and-2.pdf
    • http://www.gorillawalker.com/your-money-and-your-brain-how-the-new-science-of.pdf
    • http://www.gorillawalker.com/critical-care-quick-look-series.pdf
    • http://www.gorillawalker.com/the-new-concrete-visual-poetry-in-the-21st-century.pdf
    • http://www.gorillawalker.com/against-all-enemies-jag-in-space-4.pdf
    • http://www.gorillawalker.com/the-hspt-coach-reading-paperback.pdf
    • http://www.gorillawalker.com/concerto-for-flute-violin-and-cello-twv-53-a2-tafelmusik.pdf
    • http://www.gorillawalker.com/on-the-music-of-the-north-american-indians.pdf
    • http://www.gorillawalker.com/belwin-master-solos-trumpet-vol-1-advanced.pdf
    • http://www.gorillawalker.com/baldur-s-gate-ii-shadows-of-amn-boss-fight-books.pdf
    • http://www.gorillawalker.com/whiskers-of-a-chance.pdf
    • http://www.gorillawalker.com/jim-brickman-homecoming-piano-vocal-chords.pdf
    • http://www.gorillawalker.com/descartes-natural-philosophy-routledge-studies-in-seventeenth-century-philosophy.pdf
    • http://www.gorillawalker.com/squeeze-in-tight-dragon-s-on-the-right-the-silly.pdf
    • http://www.gorillawalker.com/dagger-four-is-ok-brig-gen-norman-c-gaddis-pow.pdf
    • http://www.gorillawalker.com/the-garments-of-court-and-palace-machiavelli-and-the-world.pdf
    • http://www.gorillawalker.com/living-in-normandy-living-in-series.pdf
    • http://www.gorillawalker.com/deciphering-earth-history-exercises-in-historical-geology.pdf
    • http://www.gorillawalker.com/degenerate-moderns-modernity-as-rationalized-sexual-misbehavior.pdf
    • http://www.gorillawalker.com/all-shots-a-dog-lover-s-mystery.pdf
    • http://www.gorillawalker.com/star-wars-luke-skywalker-last-hope-for-the-galaxy.pdf
    • http://www.gorillawalker.com/western-fertilizer-handbook.pdf
    • http://www.gorillawalker.com/ausziehen-leicht-gemacht-in-10-schritten-zur-ersten-eigenen-wohnung.pdf
    • http://www.gorillawalker.com/the-effect-of-wrap-around-fins-on-aerodynamic-stability-and.pdf
    • http://www.gorillawalker.com/monster-vol-3-the-perfect-edition.pdf
    • http://www.gorillawalker.com/how-to-rent-rooms-in-america-how-i-made-millions.pdf
    • http://www.gorillawalker.com/building-facades-faces-figures-and-o
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.