Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a68fab2931211cb…

MALICIOUS

PDF

44.1 KB Created: 2019-02-13 21:05:13 +03:00 Authoring application: Adobe PageMaker 6.5 (via Acrobat Distiller 5.0 (Windows))
MD5: 0f9c595ba0e978a3c86415a7e756840c SHA-1: 34e447917bfffe530484cd5eb64ba5f7efbc50b8 SHA-256: 4a68fab2931211cbe48d4f371df306207a3858379c255f7b29d10f41ca12997c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or distribute malicious content via numerous links. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/applied-rocket-propulsion-aerospace-series-pep.pdf
    • http://www.gorillawalker.com/mineral-resources-appraisal-mineral-endowment-resources-and-potential-supply-concepts.pdf
    • http://www.gorillawalker.com/holt-allez-viens-intermediate-reader-joie-de-lire-level-2.pdf
    • http://www.gorillawalker.com/hematology-and-transfusion-medicine-board-review-made-simple-case-series.pdf
    • http://www.gorillawalker.com/eye-to-eye-the-quest-for-the-new-paradigm-kindle.pdf
    • http://www.gorillawalker.com/the-oxford-christening-bible-authorized-king-james-version.pdf
    • http://www.gorillawalker.com/more-songs-from-glee-pro-vocal-songbook-cd-for-women.pdf
    • http://www.gorillawalker.com/black-holes-wormholes-and-time-machines.pdf
    • http://www.gorillawalker.com/the-joy-of-family-camping.pdf
    • http://www.gorillawalker.com/american-sniper-by-chris-kyle-a-20-minute-summary-the.pdf
    • http://www.gorillawalker.com/the-lincoln-assassination-crime-and-punishment-myth-and-memory-a.pdf
    • http://www.gorillawalker.com/time-for-a-tale-tailybone-scary-tales.pdf
    • http://www.gorillawalker.com/susan-b-anthony-1845-1928-america-in-the-time-of.pdf
    • http://www.gorillawalker.com/hieronymus-bosch-complete-works.pdf
    • http://www.gorillawalker.com/der-schokoladentester-teil-1-von-2-die-besten-schokoladen-und.pdf
    • http://www.gorillawalker.com/manuscripts-in-transition-recycling-manuscripts-texts-and-images-corpus-of.pdf
    • http://www.gorillawalker.com/fachkundenachweis-rettungsdienst.pdf
    • http://www.gorillawalker.com/wine-tasting-for-a-novice-the-basics-of-everything-you.pdf
    • http://www.gorillawalker.com/tradition-in-a-rootless-world-women-turn-to-orthodox-judaism.pdf
    • http://www.gorillawalker.com/my-science-book-of-electricity.pdf
    • http://www.gorillawalker.com/princess-academy.pdf
    • http://www.gorillawalker.com/race-and-education-the-roles-of-history-and-society-in.pdf
    • http://www.gorillawalker.com/construction-law-for-managers-architects-and-engineers-by-white-nancy.pdf
    • http://www.gorillawalker.com/native-american-new-england-cooking-cookbook.pdf
    • http://www.gorillawalker.com/the-lost-world-and-other-thrilling-tales-penguin-classics.pdf
    • http://www.gorillawalker.com/branding-creating-an-identity-on-the-web-digital-and-information.pdf
    • http://www.gorillawalker.com/knights-of-the-blood-knights-of-the-blood-vampyr-ss.pdf
    • http://www.gorillawalker.com/master-guide-for-photographing-high-school-seniors.pdf
    • http://www.gorillawalker.com/prescription-for-laughter-handling-health-care-hassles-with-humor.pdf
    • http://www.gorillawalker.com/science-awakening-i-egyptian-babylonian-and-greek-mathematics.pdf
    • http://www.gorillawalker.com/workouts-in-a-binder-swim-workouts-for-triathletes.pdf
    • http://www.gorillawalker.com/the-storm-before-the-calm.pdf
    • http://www.gorillawalker.com/jupiter-isaac-asimov-biblioteca-del-universo-siglo-xxi-el-sistema.pdf
    • http://www.gorillawalker.com/cantona-when-the-seagull-flew.pdf
    • http://www.gorillawalker.com/creepy-cute-crochet-zombies-ninjas-robots-and-more.pdf
    • http://www.gorillawalker.com/gregory-s-pita-pocket-full-of-simple-greek-recipes.pdf
    • http://www.gorillawalker.com/better-red-the-writing-and-resistance-of-tillie-olsen-and.pdf
    • http://www.gorillawalker.com/three-point-shot.pdf
    • http://www.gorillawalker.com/surrender-ultra-alpha-age-play-abdl-romance-forever-little-book.pdf
    • http://www.gorillawalker.com/black-swan-lake-life-of-a-wetland-intellect-books-cultural.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.