Malicious PDF — malware analysis report

Static analysis result for SHA-256 51e164550b03e29c…

MALICIOUS

PDF

33.9 KB Created: 2019-05-24 00:42:11 +03:00 Authoring application: FrameMaker 10.0.2 (via Acrobat Distiller 11.0 (Windows))
MD5: a669924d1b4938ffeaa83e29a6ca9d35 SHA-1: a1b68df5f9a5849e8c683d9e6a47a94fc53321b7 SHA-256: 51e164550b03e29ce74b377361d193178d18041c33e262a62310125fd0132969
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. While no scripts were extracted, the sheer volume of links suggests a malicious intent, possibly to manipulate search engine results or to serve as a distribution point for further malicious content. The document body was heavily obfuscated and contained the URLs directly.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8313

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/safety-standards-for-electrical-and-electronic-test-measuring-controlling-and.pdf
    • http://www.gorillawalker.com/vanishing-acts-a-science-fiction-anthology.pdf
    • http://www.gorillawalker.com/brussels-belgium-the-knowledge-economy.pdf
    • http://www.gorillawalker.com/damn-yankees-vocal-score.pdf
    • http://www.gorillawalker.com/reading-paulo-freire-suny-series-teacher-empowerment-school-reform.pdf
    • http://www.gorillawalker.com/practical-handbook-of-dewey-decimal-classification.pdf
    • http://www.gorillawalker.com/the-audubon-society-field-guide-to-the-natural-places-of.pdf
    • http://www.gorillawalker.com/asset-price-dynamics-volatility-and-prediction.pdf
    • http://www.gorillawalker.com/wildlife-photographer-of-the-year-portfolio-21.pdf
    • http://www.gorillawalker.com/locomotive-appliances.pdf
    • http://www.gorillawalker.com/mutual-vulnerability-in-the-indus-basin-integrated-water-security-as.pdf
    • http://www.gorillawalker.com/little-women-box-set-2-bdsm-ageplay-romance.pdf
    • http://www.gorillawalker.com/bmw-m5-gold-portfolio-1980-2003.pdf
    • http://www.gorillawalker.com/monte-carlo-simulation-for-econometricians-foundations-and-trends-r-in.pdf
    • http://www.gorillawalker.com/dance-of-days-two-decades-of-punk-in-the-nation.pdf
    • http://www.gorillawalker.com/capital-punishment-in-twentieth-century-britain-audience-justice-memory.pdf
    • http://www.gorillawalker.com/it-s-not-luck-marketing-production-and-the-theory-of.pdf
    • http://www.gorillawalker.com/in-harm-s-way-sun-valley-series.pdf
    • http://www.gorillawalker.com/when-darkness-falls.pdf
    • http://www.gorillawalker.com/cityscape-ben-johnson-s-liverpool-national-museums-liverpool.pdf
    • http://www.gorillawalker.com/mapping-modern-theology-a-thematic-and-historical-introduction.pdf
    • http://www.gorillawalker.com/internet-television-streaming-copyright-law-and-the-aereo-supreme-court.pdf
    • http://www.gorillawalker.com/a-comparison-of-the-montre-129-al-and-dallas-pedestrian.pdf
    • http://www.gorillawalker.com/rough-waters-the-life-of-a-naval-intelligence-officer.pdf
    • http://www.gorillawalker.com/student-solutions-manual-for-aufmann-barker-nation-s-college-trigonometry.pdf
    • http://www.gorillawalker.com/the-triumph-of-internationalism-franklin-d-roosevelt-and-a-world.pdf
    • http://www.gorillawalker.com/scientific-metaphysics.pdf
    • http://www.gorillawalker.com/where-to-ski-and-snowboard-2010-the-1-000-best.pdf
    • http://www.gorillawalker.com/living-will-forms.pdf
    • http://www.gorillawalker.com/stand-strong-1-peter-paperback.pdf
    • http://www.gorillawalker.com/herb-martinez-s-guide-to-pinstriping-publisher-krause-publications.pdf
    • http://www.gorillawalker.com/cliffsnotes-sat-cram-plan-cliffsnotes-cram-plan.pdf
    • http://www.gorillawalker.com/children-are-born-mathematicians-supporting-mathematical-development-birth-to-age.pdf
    • http://www.gorillawalker.com/basic-developing-printing-in-black-and-white-kodak-publication-aj.pdf
    • http://www.gorillawalker.com/the-handbook-of-meteorology.pdf
    • http://www.gorillawalker.com/365-effortless-household-hints-and-tips-365-perpetual-calendars.pdf
    • http://www.gorillawalker.com/growth-of-religious-and-moral-ideas-in-egypt.pdf
    • http://www.gorillawalker.com/montgomery-ward-adventures-in-microwave-cooking.pdf
    • http://www.gorillawalker.com/character-quest-vol-1-student.pdf
    • http://www.gorillawalker.com/bringing-up-b.pdf
    • http://www.gorillawalker.com/dance-of-days-two-decades-of-pu
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.