Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b8413874cc5fe32…

MALICIOUS

PDF

34.3 KB Created: 2020-02-20 05:54:07 +03:00 Authoring application: - (via Acrobat Distiller 5.0.5 (Windows))
MD5: b7027415902b5f2753121d32a443e97d SHA-1: 7746f7dab7053d0de36483089b1949b4e639c8da SHA-256: 4b8413874cc5fe32ee5d9d05963f5852165caf74ad625dd4a703c4b54664a31f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The document body is heavily obfuscated and does not provide clear user-facing text, but the sheer volume of links suggests a malicious intent, possibly for SEO manipulation or to distribute further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/soul-stripper-a-soul-stripper-romance.pdf
    • http://www.gorillawalker.com/the-search-for-god-in-ancient-egypt.pdf
    • http://www.gorillawalker.com/benjamin-banneker-black-americans-of-achievement.pdf
    • http://www.gorillawalker.com/surfing-with-turtles-bindi-wildlife-adventures-bindi-s-wildlife-adventures.pdf
    • http://www.gorillawalker.com/cracking-the-ged-2013-edition-college-test-preparation.pdf
    • http://www.gorillawalker.com/mum-s-the-word.pdf
    • http://www.gorillawalker.com/wanderings-of-an-artist-among-the-indians-of-north-america.pdf
    • http://www.gorillawalker.com/dievs-ir-lacis-lieldienu-surprise-latvian-edition.pdf
    • http://www.gorillawalker.com/girl-in-a-band-a-memoir.pdf
    • http://www.gorillawalker.com/the-oxford-history-of-the-roman-world.pdf
    • http://www.gorillawalker.com/st-francis-river-below-the-latitude-of-oak-donnick-ark.pdf
    • http://www.gorillawalker.com/my-pet-with-ukulele-arrangement-horace-heidts-on-cover.pdf
    • http://www.gorillawalker.com/increasing-patient-satisfaction-a-guide-for-nurses.pdf
    • http://www.gorillawalker.com/human-sectional-anatomy-pocket-atlas-of-body-sections-ct-and.pdf
    • http://www.gorillawalker.com/comprehensive-biotechnology-second-edition.pdf
    • http://www.gorillawalker.com/my-soul-stained-my-seed-sour-a-collection-of-poems.pdf
    • http://www.gorillawalker.com/the-temple-whores-of-india-part-1-the-escape-the.pdf
    • http://www.gorillawalker.com/readings-for-logical-analysis-second-edition.pdf
    • http://www.gorillawalker.com/life-of-insects.pdf
    • http://www.gorillawalker.com/learn-german-with-stories-ahoi-aus-hamburg-10-short-stories.pdf
    • http://www.gorillawalker.com/signor-marconi-s-magic-box-the-most-remarkable-invention-of.pdf
    • http://www.gorillawalker.com/submission-beautiful-liars-1-siren-publishing-allure.pdf
    • http://www.gorillawalker.com/using-civilian-records-for-genealogical-research-in-the-national-archives.pdf
    • http://www.gorillawalker.com/clifford-s-phonics-fun-boxed-set-1.pdf
    • http://www.gorillawalker.com/environment-an-interdisciplinary-anthology.pdf
    • http://www.gorillawalker.com/chemical-analysis-of-firearms-ammunition-and-gunshot-residue-international-forensic.pdf
    • http://www.gorillawalker.com/forest-insects-principles-and-practice-of-population-management-population-ecology.pdf
    • http://www.gorillawalker.com/wanderings-on-writing.pdf
    • http://www.gorillawalker.com/a-tutor-s-guide-helping-writers-one-to-one-second.pdf
    • http://www.gorillawalker.com/web-analytics-action-hero-using-analysis-to-gain-insight-and.pdf
    • http://www.gorillawalker.com/scientific-fasting-the-ancient-and-modern-key-to-health.pdf
    • http://www.gorillawalker.com/entropy-and-low-temperature-physics.pdf
    • http://www.gorillawalker.com/plumb-line-poems.pdf
    • http://www.gorillawalker.com/model-engineering-in-mixed-signal-circuit-design-a-guide-to.pdf
    • http://www.gorillawalker.com/utilitarianism-liberty-representative-government.pdf
    • http://www.gorillawalker.com/talks-my-father-never-had-with-me-helping-the-young.pdf
    • http://www.gorillawalker.com/elementary-statistical-quality-control-first-edition-statistics-a-series-of.pdf
    • http://www.gorillawalker.com/the-death-of-caligula-flavius-josephus.pdf
    • http://www.gorillawalker.com/solitary-escape-from-furnace-series.pdf
    • http://www.gorillawalker.com/transforming-field-and-service-operations-methodologies-for-successful-technology-driven.pdf
    • http://www.gorillawalker.com/wanderings-of-an
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.