Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d16026ab05cf27b…

MALICIOUS

PDF

42.6 KB Created: 2018-12-11 20:29:24 +03:00 Authoring application: dvips(k) 5.993 Copyright 2013 Radical Eye Software (via GPL Ghostscript 9.07)
MD5: 921b9cb1df698866ae172c7ff16254be SHA-1: 4c0d365de1845b4030c9f8e19f507d22c777eb15 SHA-256: 4d16026ab05cf27b30fcc698cd595a0c824af7156cb3315b7de785c343ecc0da
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. A critical heuristic identified a large number of external links embedded within the document, suggesting a link farm or distribution mechanism. The document body contains obfuscated data rather than user-readable content, reinforcing the malicious intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/group-supervision-a-guide-to-creative-practice-counselling-supervision-series.pdf
    • http://www.gorillawalker.com/educational-spaces-vol-2-a-pictorial-review-volume-ii.pdf
    • http://www.gorillawalker.com/the-wadsworth-anthology-of-poetry-with-poetry-21-cd-rom.pdf
    • http://www.gorillawalker.com/kettlebell-rx-the-complete-guide-for-athletes-and-coaches.pdf
    • http://www.gorillawalker.com/principles-of-external-auditing.pdf
    • http://www.gorillawalker.com/clinical-atlas-of-peripheral-retinal-disorders.pdf
    • http://www.gorillawalker.com/colombia-its-present-state-in-respect-of-climate-soil-productions.pdf
    • http://www.gorillawalker.com/500-chairs-celebrating-traditional-innovative-designs-500-series.pdf
    • http://www.gorillawalker.com/levi-sprocket-what-s-in-my-pocket-kindle-edition.pdf
    • http://www.gorillawalker.com/hellboy-vol-12-the-storm-and-the-fury.pdf
    • http://www.gorillawalker.com/jack-robb-kidnapped-a-biker-brothers-tale.pdf
    • http://www.gorillawalker.com/a-color-atlas-of-carbonate-sediments-and-rocks-under-the.pdf
    • http://www.gorillawalker.com/ber-die-g-tter-der-vier-elemente-bei-den-gyptern.pdf
    • http://www.gorillawalker.com/murder-in-calico-gold-a-cedar-bay-cozy-mystery.pdf
    • http://www.gorillawalker.com/home-and-home-again.pdf
    • http://www.gorillawalker.com/the-english-garden-calendar.pdf
    • http://www.gorillawalker.com/how-to-think-the-unthinkable-based-on-antigone-oberon-plays.pdf
    • http://www.gorillawalker.com/200-multiplication-worksheets-with-5-digit-multiplicands-5-digit-multipliers.pdf
    • http://www.gorillawalker.com/a-journey-from-london-to-genoa-through-england-portugal-spain.pdf
    • http://www.gorillawalker.com/extreme-gay-submission-violated-by-men.pdf
    • http://www.gorillawalker.com/walk-yourself-thin-walk-10-000-steps-to-feel-great.pdf
    • http://www.gorillawalker.com/instruct-to-israelitess-digital-concordance-book-47-digital-concordance-of.pdf
    • http://www.gorillawalker.com/how-to-rebuild-gm-ls-series-engines-s-a-design.pdf
    • http://www.gorillawalker.com/european-blue-list-european-drug-registrations-ring-bound-edition.pdf
    • http://www.gorillawalker.com/take-the-all-mart-reprobates-of-the-wasteland.pdf
    • http://www.gorillawalker.com/the-creativity-cure-a-do-it-yourself-prescription-for-happiness.pdf
    • http://www.gorillawalker.com/anti-capitalism-and-culture-radical-theory-and-popular-politics.pdf
    • http://www.gorillawalker.com/voice-tantra-yoga-mantra-harmony-of-inner-and-expressed-voice.pdf
    • http://www.gorillawalker.com/ocr-a2-geography-student-guide-f764-geographical-skills.pdf
    • http://www.gorillawalker.com/el-futuro-de-la-arquitectura-spanish-edition.pdf
    • http://www.gorillawalker.com/tutankhamun-the-secrets-of-the-tomb-and-the-life-of.pdf
    • http://www.gorillawalker.com/an-inquiry-into-the-nature-and-causes-of-the-wealth.pdf
    • http://www.gorillawalker.com/il-trattamento-cognitivo-comportamentale-dell-insonnia-linee-guida-per-la.pdf
    • http://www.gorillawalker.com/notes-on-the-bibliography-of-yucatan-and-central-america-comprising.pdf
    • http://www.gorillawalker.com/trademarks-and-unfair-competition-law-and-policy-fourth-edition-aspen.pdf
    • http://www.gorillawalker.com/nerdy-shy-and-socially-inappropriate-a-user-guide-to-an.pdf
    • http://www.gorillawalker.com/day-trading-forex-for-profit-how-to-survive-and-thrive.pdf
    • http://www.gorillawalker.com/stevie.pdf
    • http://www.gorillawalker.com/lww-infection-control-for-dental-assisting-workbook.pdf
    • http://www.gorillawalker.com/cognac-conspiracies-winemaker-detective.pdf
    • http://www.gorillawalker.com/colombia-its-prese
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.