Malicious PDF — malware analysis report

Static analysis result for SHA-256 539f3fb182ce75a9…

MALICIOUS

PDF

33.4 KB Created: 2019-12-14 05:22:09 +03:00 Authoring application: ZonBook XSL Stylesheets with Apache FOP (via Apache FOP Version 2.1)
MD5: e2f8000c0d03f925291fd1c874418826 SHA-1: 722ddee86b3f64e1833a0940ea5aee1791512cba SHA-256: 539f3fb182ce75a9dd9f2d4c5b3072f78627d95fda3ebc1fe0b4602135e46451
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a machine learning classifier as malicious and contains a large number of embedded links to external PDF files. This behavior is consistent with a link farm or SEO poisoning attack, designed to drive traffic to a specific domain. The primary technique observed is the distribution of numerous external links, likely to manipulate search engine rankings or lure users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/myself-and-i-kimani-tru.pdf
    • http://www.gorillawalker.com/molecular-diversity-and-combinatorial-chemistry-libraries-and-drug-discovery-conference.pdf
    • http://www.gorillawalker.com/sqa-past-papers-in-intermediate-2-mathematics-2001-2003-units.pdf
    • http://www.gorillawalker.com/the-sultan-and-his-subjects-an-ottoman-history.pdf
    • http://www.gorillawalker.com/the-modern-cook-a-practical-guide-to-the-culinary-art.pdf
    • http://www.gorillawalker.com/john-dee-interdisciplinary-studies-in-english-renaissance-thought-international-archives.pdf
    • http://www.gorillawalker.com/little-jane-silver-teachers-guide-dundurn-teachers-guide.pdf
    • http://www.gorillawalker.com/holding-out-hawks-motorcycle-club-series-volume-1.pdf
    • http://www.gorillawalker.com/the-circle-home-a-novel.pdf
    • http://www.gorillawalker.com/chemistry-the-molecular-nature-of-matter.pdf
    • http://www.gorillawalker.com/willow-ware-ceramics-in-the-chinese-tradition-with-price-guide.pdf
    • http://www.gorillawalker.com/expulsion-of-the-palestinians-the-concept-of-transfer-in-zionist.pdf
    • http://www.gorillawalker.com/chippy-goes-to-the-dentist.pdf
    • http://www.gorillawalker.com/standard-calculation-methods-for-structural-fire-protection-asce-sei-sfpe.pdf
    • http://www.gorillawalker.com/mothertrucker-beat-speeding-tickets-for-truck-van-and-coach-drivers.pdf
    • http://www.gorillawalker.com/first-50-classical-pieces-you-should-play-on-the-piano.pdf
    • http://www.gorillawalker.com/entrevista-diagn.pdf
    • http://www.gorillawalker.com/parasite-eve-ii-official-strategy-guide-bradygames-strategy-guides.pdf
    • http://www.gorillawalker.com/cluster-based-industrial-development-a-comparative-study-of-asia-and.pdf
    • http://www.gorillawalker.com/tech-assassins-cads-no-12.pdf
    • http://www.gorillawalker.com/in-home-child-care-a-step-by-step-guide-to.pdf
    • http://www.gorillawalker.com/california-criminal-procedure.pdf
    • http://www.gorillawalker.com/blackmailed-an-erotic-tale-of-revenge-and-desire.pdf
    • http://www.gorillawalker.com/circle-of-friends-the-massive-federal-crackdown-on-insider-trading.pdf
    • http://www.gorillawalker.com/regional-business-directory-norfolk-richmond-va.pdf
    • http://www.gorillawalker.com/benjamin-and-tulip.pdf
    • http://www.gorillawalker.com/precision-pendulum-clocks-the-quest-for-accurate-timekeeping-a-schiffer.pdf
    • http://www.gorillawalker.com/diversi-n-en-el-estanque-de-los-patos-duck-pond.pdf
    • http://www.gorillawalker.com/summer-grasses-an-anthology-of-war-poetry.pdf
    • http://www.gorillawalker.com/class-field-theory-from-theory-to-practice-springer-monographs-in.pdf
    • http://www.gorillawalker.com/nakazawa-himeka-girl-japanese-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/a-hunter-s-cookbook-a-practical-step-by-step-guide.pdf
    • http://www.gorillawalker.com/heath-grammar-and-composition-complete-course.pdf
    • http://www.gorillawalker.com/the-executive-guide-to-integrated-talent-management.pdf
    • http://www.gorillawalker.com/oxford-aqa-history-for-a-level-tsarist-and-communist-russia.pdf
    • http://www.gorillawalker.com/children-s-guitar-hymnal.pdf
    • http://www.gorillawalker.com/cologne-city-streets.pdf
    • http://www.gorillawalker.com/soccer-coaching-curriculum-for-12-18-year-old-players-volume.pdf
    • http://www.gorillawalker.com/proteggi-la-tua-impresa-salva-i-tuoi-crediti-guida-pratica.pdf
    • http://www.gorillawalker.com/the-princess-and-the-billionaire-book-1-bbw-billionaire-romance.pdf
    • http://www.gorillawalker.com/expulsion-of-the-palestinia
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.