Malicious PDF — malware analysis report

Static analysis result for SHA-256 5cbb8c362e8e8d38…

MALICIOUS

PDF

45.4 KB Created: 2018-12-02 20:17:50 +03:00 Authoring application: Writer (via OpenOffice.org 2.0.3)
MD5: 55151433dd6a41c0e5825cd0e87a111d SHA-1: 400587d51396899cbe39804dcb1b16abcaafa514 SHA-256: 5cbb8c362e8e8d385f754945ccdb5220e1b60a3b52098c1bd24d6c796d0bdf9b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. The primary attack pattern appears to be the distribution of a link farm, potentially for SEO manipulation or to serve as a distribution point for other malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/book-of-lists-v-1.pdf
    • http://www.gorillawalker.com/rural-nursing-fourth-edition-concepts-theory-and-practice-kindle-edition.pdf
    • http://www.gorillawalker.com/eureka-math-a-story-of-functions-algebra-i-module-3.pdf
    • http://www.gorillawalker.com/i-didn-t-know-that-why-we-say-the-things.pdf
    • http://www.gorillawalker.com/christmas-on-record-best-selling-xmas-singles-and-albums-of.pdf
    • http://www.gorillawalker.com/luke-powell-afghan-gold.pdf
    • http://www.gorillawalker.com/time-couriers.pdf
    • http://www.gorillawalker.com/holt-rinehart-and-winston-algebra-1-reteaching-masters.pdf
    • http://www.gorillawalker.com/caw-caw-or-the-chronicle-of-crows-in-verse-by.pdf
    • http://www.gorillawalker.com/the-market-savvy-investor-profit-from-the-techniques-of-the.pdf
    • http://www.gorillawalker.com/the-harmonic-structure-of-movement-music-and-dance-according-to.pdf
    • http://www.gorillawalker.com/clinical-handbook-for-kozier-erb-s-fundamentals-of-nursing-9th.pdf
    • http://www.gorillawalker.com/victoria-s-beginning-breaking-the-line-books-book-1-kindle.pdf
    • http://www.gorillawalker.com/us-army-mine-countermine-kindle-edition.pdf
    • http://www.gorillawalker.com/ni0-art-works-nishi-s-alluring-figures.pdf
    • http://www.gorillawalker.com/milet-bilingual-visual-dictionary-english-arabic.pdf
    • http://www.gorillawalker.com/aerodynamic-coefficient-predictions-for-a-projectile-configuration-at-transonic-speeds.pdf
    • http://www.gorillawalker.com/extra-large-print-word-search-volume-13.pdf
    • http://www.gorillawalker.com/the-ultimate-pearly-penile-papules-removal-system-how-to-remove.pdf
    • http://www.gorillawalker.com/el-seiscientos-que-quiso-ser-un-porsche-spanish-edition.pdf
    • http://www.gorillawalker.com/stability-with-growth-macroeconomics-liberalization-and-development-initiative-for-policy.pdf
    • http://www.gorillawalker.com/hot-sexy-anime-girls-vol-5-kindle-edition.pdf
    • http://www.gorillawalker.com/thermally-non-aggressive-atmospheric-pressure-plasma-generation-characterization-applications.pdf
    • http://www.gorillawalker.com/excel-with-objective-questions-in-inorganic-chemistry.pdf
    • http://www.gorillawalker.com/businss-writing-for-busy-people.pdf
    • http://www.gorillawalker.com/the-iliad-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/time-line-therapy-and-the-basis-of-personality.pdf
    • http://www.gorillawalker.com/rations-of-the-german-wehrmacht-in-world-war-ii.pdf
    • http://www.gorillawalker.com/allies-in-healing-when-the-person-you-love-was-sexually.pdf
    • http://www.gorillawalker.com/the-christian-faith-an-introduction-to-christian-doctrine.pdf
    • http://www.gorillawalker.com/the-making-of-classical-edinburgh.pdf
    • http://www.gorillawalker.com/package-the-thyroid-cancer-book-and-the-low-iodine-diet.pdf
    • http://www.gorillawalker.com/peak-relational-training-system-direct-training-module.pdf
    • http://www.gorillawalker.com/from-margin-to-mainstream-american-women-and-politics-since-1960.pdf
    • http://www.gorillawalker.com/biomechanics-of-human-motion-applications-in-the-martial-arts.pdf
    • http://www.gorillawalker.com/the-best-of-yanni-fingerstyle-guitar.pdf
    • http://www.gorillawalker.com/the-death-penalty-both-sides-of-the-story.pdf
    • http://www.gorillawalker.com/the-gallagher-way-hardcover.pdf
    • http://www.gorillawalker.com/enciclopedia-m-dica-pr-ctica-gu-a-contra-el-dolor.pdf
    • http://www.gorillawalker.com/haustechnik-grundlagen-planung-ausf-hrung-german-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.