Malicious PDF — malware analysis report

Static analysis result for SHA-256 55b8f27461c449a5…

MALICIOUS

PDF

43.3 KB Created: 2018-11-14 11:30:54 +03:00 Authoring application: Adobe PageMaker 6.5 (via Acrobat Distiller 5.0 (Windows))
MD5: a0ec45ea2b53f77fba8fcfc163a60835 SHA-1: b53eb7913aae4223edac32a1a030d5613b5a7683 SHA-256: 55b8f27461c449a59d67764185c4bbfab8cdbeea52c4f6cd7e95d2f1ed16ca21
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or redirection tactic. The ML classifier also indicated a high probability of maliciousness. While no scripts were extracted, the sheer volume of links to seemingly unrelated PDF documents on the same domain points towards an SEO manipulation or a potential phishing/malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9007

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/clymer-yamaha-outboard-shop-manual-2-250-hp-two-stroke.pdf
    • http://www.gorillawalker.com/cal-99-old-iron-calendar.pdf
    • http://www.gorillawalker.com/francisco-el-papa-de-la-gente.pdf
    • http://www.gorillawalker.com/big-day-at-the-ekka-aussie-mates-in-the-outback.pdf
    • http://www.gorillawalker.com/mejorando-la-producci-n-con-lean-thinking-improving-production-with.pdf
    • http://www.gorillawalker.com/rebirth-reawakened.pdf
    • http://www.gorillawalker.com/loose-leaf-macroeconomics-brief-edition.pdf
    • http://www.gorillawalker.com/sex-therapy-volume-1-the-oral-exam.pdf
    • http://www.gorillawalker.com/tales-from-africa.pdf
    • http://www.gorillawalker.com/respiratory-function-in-disease-1e.pdf
    • http://www.gorillawalker.com/common-slang-dictionary.pdf
    • http://www.gorillawalker.com/coaching-manual-the-definitive-guide-to-the-process-principles-skills.pdf
    • http://www.gorillawalker.com/58-minutes-basis-for-the-film-die-hard-2.pdf
    • http://www.gorillawalker.com/2016-quotable-magnetic-calendar.pdf
    • http://www.gorillawalker.com/down-from-the-mountain.pdf
    • http://www.gorillawalker.com/reflexology-beginners-guide-to-ancient-techniques-for-hand-foot-de.pdf
    • http://www.gorillawalker.com/idaho-and-montana-gold-regions-the-emigrant-s-guide-overland.pdf
    • http://www.gorillawalker.com/new-histories-for-old-changing-perspectives-on-canada-s-native.pdf
    • http://www.gorillawalker.com/wood-chemistry-second-edition-fundamentals-and-applications.pdf
    • http://www.gorillawalker.com/an-introduction-to-aesthetics.pdf
    • http://www.gorillawalker.com/michelin-map-germany-southeast-546-maps-regional-michelin.pdf
    • http://www.gorillawalker.com/crime-the-game-the-whole-family-can-play.pdf
    • http://www.gorillawalker.com/handbook-of-irrigation-and-drainage.pdf
    • http://www.gorillawalker.com/sky-doll-decade.pdf
    • http://www.gorillawalker.com/purification-of-the-heart-signs-symptoms-and-cures-of-the.pdf
    • http://www.gorillawalker.com/media-law-for-producers.pdf
    • http://www.gorillawalker.com/sword-dance-a-woman-s-story-a-celtic-poem.pdf
    • http://www.gorillawalker.com/audels-electric-motor-guide.pdf
    • http://www.gorillawalker.com/time-to-call-911.pdf
    • http://www.gorillawalker.com/the-passionate-years-neglected-books-of-the-20th-century.pdf
    • http://www.gorillawalker.com/ocean-magazine-girls-guide-to-new-zealand-ocean-magazine-girls.pdf
    • http://www.gorillawalker.com/whistling-women.pdf
    • http://www.gorillawalker.com/derrubando-golias-descubra-como-superar-os-maiores-obst-culos-de.pdf
    • http://www.gorillawalker.com/the-awakened-self-encounters-with-zen-kodansha-globe-series.pdf
    • http://www.gorillawalker.com/favre-the-man-the-legend-with-cd.pdf
    • http://www.gorillawalker.com/jews-in-nazi-berlin-from-kristallnacht-to-liberation-studies-in.pdf
    • http://www.gorillawalker.com/new-lifepac-grade-9-aop-4-subject-box-set-math.pdf
    • http://www.gorillawalker.com/listening-prayer-learning-to-hear-god-s-voice-and-keep.pdf
    • http://www.gorillawalker.com/history-of-the-sixtieth-regiment-new-york-state-volunteers-from.pdf
    • http://www.gorillawalker.com/3000-italiano-islandese-islandese-italiano-vocabolario-italian-edition.pdf
    • http://www.gorillawalker
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.