Malicious PDF — malware analysis report

Static analysis result for SHA-256 567df11efb0ac585…

MALICIOUS

PDF

44.0 KB Created: 2018-12-02 10:56:14 +03:00 Authoring application: LaTeX with hyperref package (via xdvipdfmx (0.7.8)) First seen: 2019-01-20
MD5: bbc90b160c67ae84a3dadec5044cd338 SHA-1: 68e68d528cb2bec74616426a9bcbde4676e16d51 SHA-256: 567df11efb0ac58529b7e756bc64a003a2410f97e0dd81cfcf44ba1013e010da
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The ML classifier flagged this PDF as malicious with a high probability. The document contains numerous embedded URLs pointing to external resources, suggesting a phishing or credential harvesting attempt. No scripts were extracted, limiting further analysis of the payload delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8452

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/epsilon-fractions-test-booklet-math-u-see.pdf In PDF document text
    • http://www.gorillawalker.com/clifford-algebras-with-numeric-and-symbolic-computations.pdfIn PDF document text
    • http://www.gorillawalker.com/the-heart-of-a-servant-leader-letters-from-jack-miller.pdfIn PDF document text
    • http://www.gorillawalker.com/outposts-journeys-to-the-surviving-relics-of-the-british-empire.pdfIn PDF document text
    • http://www.gorillawalker.com/leisure-plantations-and-the-making-of-a-new-south-the.pdfIn PDF document text
    • http://www.gorillawalker.com/crisis-ministries-classical-pastoral-care-v-1.pdfIn PDF document text
    • http://www.gorillawalker.com/odds-on-favorite-winning-odds-series-volume-2.pdfIn PDF document text
    • http://www.gorillawalker.com/globalectics-theory-and-the-politics-of-knowing-the-wellek-library.pdfIn PDF document text
    • http://www.gorillawalker.com/transport-phenomena-from-the-conservation-equations-to-the-numerical-solution.pdfIn PDF document text
    • http://www.gorillawalker.com/how-to-identify-mushrooms-to-genus-ii-field-identification-of.pdfIn PDF document text
    • http://www.gorillawalker.com/jenseits-des-lustprinzips-german-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/marie-curie-against-the-odds-biographies.pdfIn PDF document text
    • http://www.gorillawalker.com/where-we-live-a-guide-to-st-louis-communities.pdfIn PDF document text
    • http://www.gorillawalker.com/tooter-pepperday-stepping-stone-paper.pdfIn PDF document text
    • http://www.gorillawalker.com/renditeperlen-aus-dem-scherbenhaufen-bankhybridkapital-in-der-finanzkrise-wie-investoren.pdfIn PDF document text
    • http://www.gorillawalker.com/english-grammar-for-students-of-french-the-study-guide-for.pdfIn PDF document text
    • http://www.gorillawalker.com/learning-and-behavior-biological-psychological-and-sociocultural-perspectives.pdfIn PDF document text
    • http://www.gorillawalker.com/lift-the-flap-computers-and-coding.pdfIn PDF document text
    • http://www.gorillawalker.com/pass-the-24-a-plain-english-explanation-to-help-you.pdfIn PDF document text
    • http://www.gorillawalker.com/how-to-rebuild-and-modify-your-muscle-car-motorbooks-workshop.pdfIn PDF document text
    • http://www.gorillawalker.com/starfinder-the-scottish-star-series-book-2-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/ashes-to-dust-las-vegas-mystery.pdfIn PDF document text
    • http://www.gorillawalker.com/jin-woo.pdfIn PDF document text
    • http://www.gorillawalker.com/when-passion-rules.pdfIn PDF document text
    • http://www.gorillawalker.com/happiness-and-education.pdfIn PDF document text
    • http://www.gorillawalker.com/emergency-care-and-workbook-and-onekey-coursecompass-student-access-card.pdfIn PDF document text
    • http://www.gorillawalker.com/railways-restored-1994-95.pdfIn PDF document text
    • http://www.gorillawalker.com/more-than-just-a-flower-garden-more-than-just-a.pdfIn PDF document text
    • http://www.gorillawalker.com/100-great-science-fiction-short-short-stories.pdfIn PDF document text
    • http://www.gorillawalker.com/the-man-slave-gay-billionaire-group-mmm-alpha-male-bdsm.pdfIn PDF document text
    • http://www.gorillawalker.com/secrets-of-karma.pdfIn PDF document text
    • http://www.gorillawalker.com/love-in-the-fast-lane.pdfIn PDF document text
    • http://www.gorillawalker.com/uncovered-rare-vintage-male-nudes.pdfIn PDF document text
    • http://www.gorillawalker.com/amyotrophic-lateral-sclerosis-neurological-disease-and-therapy.pdfIn PDF document text
    • http://www.gorillawalker.com/ford-taurus-mercury-sable-1996-thru-2005-haynes-repair-manual.pdfIn PDF document text
    • http://www.gorillawalker.com/amanda-palmer-who-killed-amanda-palmer-songbook-piano-vocal-guitar.pdfIn PDF document text
    • http://www.gorillawalker.com/matthew-barney-pace-car-for-the-hubris-pill.pdfIn PDF document text
    • http://www.gorillawalker.com/the-canadian-contingents-and-canadian-imperialism-a-story-and-a.pdfIn PDF document text
    • http://www.gorillawalker.com/yamaha-timberwolf-1989-2000-clymer-motorcycle-repair.pdfIn PDF document text
    • http://www.gorillawalker.com/bebop-licks-for-guitar-a-dictionary-of-melodic-ideas-for.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000cb3.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCB3 15719 bytes
SHA-256: a1b9233c9ed2b2aab9406b63457ac55e49c713270461156ace350bfac0757e0c

Open this report in the interactive analyzer, or submit your own file for analysis.