Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e20adab041f673b…

MALICIOUS

PDF

40.4 KB Created: 2018-12-15 20:04:31 +03:00 Authoring application: - (via ABBYY FineReader 11)
MD5: 54f37f501705ecc0adc6055fbd7db6d8 SHA-1: fd88a74c52e7d4a8ea45366069d5c5d64d466d7b SHA-256: 4e20adab041f673b0aa1b84b0e5dad46f0ca434e36fb00a992244d5be4ca6d30
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be SEO manipulation or a link farm designed to drive traffic to a specific domain, potentially as a distribution point for other malicious content or to engage in click fraud. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/pmbok-5th-edition-study-guide-01-intro-new-pmp-exam.pdf
    • http://www.gorillawalker.com/general-physics-review-kinematics-velocity-acceleration-time-and-distance-kindle.pdf
    • http://www.gorillawalker.com/tonal-consciousness-and-the-medieval-west-varia-musicologica.pdf
    • http://www.gorillawalker.com/reeds-vol-10-instrumentation-and-control-systems-reed-s-marine.pdf
    • http://www.gorillawalker.com/basics-of-web-design-html5-css3-2nd-edition.pdf
    • http://www.gorillawalker.com/b2-1-1-201-1996-r2007-swps-for-shielded-metalarc.pdf
    • http://www.gorillawalker.com/third-grade-math-for-home-school-or-extra-practice.pdf
    • http://www.gorillawalker.com/chasing-hellhounds-what-my-students-taught-me.pdf
    • http://www.gorillawalker.com/the-inhabitant-of-the-lake-other-unwelcome-tenants.pdf
    • http://www.gorillawalker.com/the-cowboy-poet.pdf
    • http://www.gorillawalker.com/2011-iron-man-2-wall-calendar.pdf
    • http://www.gorillawalker.com/cancer-cures-a-specialty-book.pdf
    • http://www.gorillawalker.com/remote-geochemical-analysis-elemental-and-mineralogical-composition-topics-in-remote.pdf
    • http://www.gorillawalker.com/desperate-measures-port-aster-secrets.pdf
    • http://www.gorillawalker.com/myth-and-sexuality-meridian.pdf
    • http://www.gorillawalker.com/promoting-purposeful-discourse-teacher-research-in-mathematics-classrooms.pdf
    • http://www.gorillawalker.com/stephen-hawking-a-quest-for-the-theory-of-everything.pdf
    • http://www.gorillawalker.com/british-columbia-interior-altitude-superguides-paperback.pdf
    • http://www.gorillawalker.com/introduction-and-allegro-for-saxophone-quartet-by-milan-kaderavek.pdf
    • http://www.gorillawalker.com/the-sexual-revolution-toward-a-self-governing-character-structure.pdf
    • http://www.gorillawalker.com/mcdougal-littell-middle-school-math-california-elect-lesson-presentations-cd.pdf
    • http://www.gorillawalker.com/joseph-baby-s-first-bible-04-kindle-edition.pdf
    • http://www.gorillawalker.com/everything-i-touch-turns-to-sold-advice-on-how-to.pdf
    • http://www.gorillawalker.com/chakras-chakras-for-beginners-the-guide-to-balancing-your-life.pdf
    • http://www.gorillawalker.com/alexandros-el-confin-del-mundo.pdf
    • http://www.gorillawalker.com/wir-lernen-deutsch-pt-2.pdf
    • http://www.gorillawalker.com/question-of-the-day-where-truth-is-the-dare.pdf
    • http://www.gorillawalker.com/introduction-to-modern-inorganic-chemistry.pdf
    • http://www.gorillawalker.com/seonaid-the-handfasting-book-2.pdf
    • http://www.gorillawalker.com/crossed-swords-book-three-gay-dominance-and-submission-erotica.pdf
    • http://www.gorillawalker.com/circular-v-956.pdf
    • http://www.gorillawalker.com/minecraft-pocket-edition-hacks-cheats-that-make-you-love-minecraft.pdf
    • http://www.gorillawalker.com/so-not-happening-the-charmed-life.pdf
    • http://www.gorillawalker.com/adventures-in-la-la-land.pdf
    • http://www.gorillawalker.com/flowers-in-the-dustbin-the-rise-of-rock-and-roll.pdf
    • http://www.gorillawalker.com/smithsonian-handbooks-birds-of-florida-smithsonian-handbooks.pdf
    • http://www.gorillawalker.com/hal-leonard-high-school-musical-recorder-songbook.pdf
    • http://www.gorillawalker.com/taboo.pdf
    • http://www.gorillawalker.com/hotel-graphics-creative-hotel-identity-designs-in-japan.pdf
    • http://www.gorillawalker.com/dyke-valiant.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.