Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c09370950384cf6…

MALICIOUS

PDF

48.5 KB Created: 2019-04-06 14:54:17 +03:00 Authoring application: XSL Formatter V4.3 MR8 for Windows (via Acrobat Distiller 7.0.5 (Windows))
MD5: f1bf03910fc9165f82b2a7804f635e00 SHA-1: 102ec32a7cdaf3d222b3f860f3f4a9813b866496 SHA-256: 5c09370950384cf654ffec3a6f112d5aaf730d70d5aa8f8959b8b424658b990d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. While no scripts were explicitly extracted, the presence of embedded URLs suggests an attempt to direct users to potentially malicious websites or for SEO manipulation. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8517

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/advances-in-visual-data-compression-and-communication-meeting-the-requirements.pdf
    • http://www.gorillawalker.com/listening-with-purpose-entry-points-into-shame-and-narcissistic-vulnerability.pdf
    • http://www.gorillawalker.com/otolaryngology-head-and-neck-surgery-rapid-clinical-and-board-review.pdf
    • http://www.gorillawalker.com/thrash-hard-hit-book-3.pdf
    • http://www.gorillawalker.com/the-gospel-of-matthew-volume-i-the-new-daily-study.pdf
    • http://www.gorillawalker.com/sharpe-shooter-cozy-suburbs-mystery-series-book-1.pdf
    • http://www.gorillawalker.com/blackout-a-riley-covington-thriller.pdf
    • http://www.gorillawalker.com/unhomely-rooms-foreign-tongues-and-spanish-american-literature-the-bucknell.pdf
    • http://www.gorillawalker.com/the-orient-in-chaucer-and-medieval-romance-studies-in-medieval.pdf
    • http://www.gorillawalker.com/winterdance-the-fine-madness-of-running-the-iditarod-by-paulsen.pdf
    • http://www.gorillawalker.com/becoming-a-word-learner-a-debate-on-lexical-acquisition-counterpoints.pdf
    • http://www.gorillawalker.com/get-dirty-don-t-get-mad.pdf
    • http://www.gorillawalker.com/cybersurgery-advanced-technologies-for-surgical-practice.pdf
    • http://www.gorillawalker.com/new-york-times-crossword-puzzle-dictionary-the.pdf
    • http://www.gorillawalker.com/tribulations-in-thailand.pdf
    • http://www.gorillawalker.com/holding-holly-a-love-and-football-novella.pdf
    • http://www.gorillawalker.com/tai-chi-and-taiji-qigong-by-danny-connor.pdf
    • http://www.gorillawalker.com/ich-will-designer-werden-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/world-futsal-magazine-plus-vol186-shoot-and-pass-from-that.pdf
    • http://www.gorillawalker.com/women-in-beckett-performance-and-critical-perspectives.pdf
    • http://www.gorillawalker.com/the-tortilla-book-paperback.pdf
    • http://www.gorillawalker.com/business-information-systems-18th-international-conference-bis-2015-poznan-poland.pdf
    • http://www.gorillawalker.com/alpha-1980-pack-christian-urban-fantasy-kindle-edition.pdf
    • http://www.gorillawalker.com/cassell-student-reference-library-cassell-student-english-dictionary-cassell-thesaurus.pdf
    • http://www.gorillawalker.com/mensa-train-your-brain-mind-melting-conundrums.pdf
    • http://www.gorillawalker.com/stock-identification-methods-applications-in-fishery-science.pdf
    • http://www.gorillawalker.com/compensation-for-environmental-damages-under-international-law-the-role-of.pdf
    • http://www.gorillawalker.com/writing-selling-drama-screenplays-writing-selling-screenplays.pdf
    • http://www.gorillawalker.com/the-gun-digest-book-of-firearms-assembly-disassembly-part-5.pdf
    • http://www.gorillawalker.com/theory-of-econometrics.pdf
    • http://www.gorillawalker.com/the-new-revised-standard-version-pocket-edition-bible-anglicized-text.pdf
    • http://www.gorillawalker.com/the-ealry-cartography-of-the-pacific-the-papers-of-the.pdf
    • http://www.gorillawalker.com/act-test-prep-algebra-review-flashcards-act-study-guide-book.pdf
    • http://www.gorillawalker.com/heparin-induced-thrombocytopenia-fifth-edition-fundamental-and-clinical-cardiology.pdf
    • http://www.gorillawalker.com/capitalism-is-dead-peoplism-rules-creating-success-out-of-corporate.pdf
    • http://www.gorillawalker.com/mission-to-mars-2025-volume-i-what-we-can-do.pdf
    • http://www.gorillawalker.com/white-mythologies.pdf
    • http://www.gorillawalker.com/gulf-war-and-health-updated-literature-review-of-depleted-uranium.pdf
    • http://www.gorillawalker.com/form-and-transformation-generative-and-relational-principles-in-biology.pdf
    • http://www.gorillawalker.com/laser-processing-of-materials-fundamentals-applications-and-developments-springer-series.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.