Malicious PDF — malware analysis report

Static analysis result for SHA-256 5da847bbdaa55adb…

MALICIOUS

PDF

46.3 KB Created: 2018-12-14 20:03:56 +03:00 Authoring application: FrameMaker 8.0 (via Acrobat Distiller 10.0.1 (Windows))
MD5: 24411a2c32b0d801fd48d42d23fc00db SHA-1: d09e04723c95b8d7cdf7caafcffafde111b7b51b SHA-256: 5da847bbdaa55adb6219ff5c7e2f9849ef71444ea38aaf07f778ad4a1bb8bc26
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests the document's primary purpose is to drive traffic to these external resources, potentially for SEO manipulation or to serve as a distribution point for other malicious content. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the immediate intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8309

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-speed-of-trust-the-one-thing-that-changes-everything.pdf
    • http://www.gorillawalker.com/impingement-jet-cooling-in-gas-turbines-developments-in-heat-transfer.pdf
    • http://www.gorillawalker.com/behind-the-success-and-failure-of-u-s-export-intermediaries.pdf
    • http://www.gorillawalker.com/measuring-transparency-to-improve-good-governance-in-the-public-pharmaceutical.pdf
    • http://www.gorillawalker.com/precalculus-second-edition.pdf
    • http://www.gorillawalker.com/before-words-psychoanalytic-listening-to-the-unsaid-through-the-medium.pdf
    • http://www.gorillawalker.com/creating-book-reports-with-cool-new-digital-tools-way-beyond.pdf
    • http://www.gorillawalker.com/maps-charts-and-graphs-level-g-the-world.pdf
    • http://www.gorillawalker.com/serenade-for-string-orchestra-op-48-simplified-arrangement-full-score.pdf
    • http://www.gorillawalker.com/financial-management-concepts-and-applications-for-health-care-organizations.pdf
    • http://www.gorillawalker.com/eat-sleep-mountain-biking-cycling-bike-red-decal-sticker-red.pdf
    • http://www.gorillawalker.com/un-muchacho-sefardi-a-sephardic-boy-spanish-edition.pdf
    • http://www.gorillawalker.com/farting-presidents-and-other-poems.pdf
    • http://www.gorillawalker.com/antigua-and-the-antiguans-a-full-account-of-the-colony.pdf
    • http://www.gorillawalker.com/the-wonderful-words-of-shakespeare-colorful-saucy-snippets-by-shakepeare.pdf
    • http://www.gorillawalker.com/nechung-el-oraculo-del-dalai-lama-sabiduria-perenne-spanish-edition.pdf
    • http://www.gorillawalker.com/sorayama-pin-up.pdf
    • http://www.gorillawalker.com/my-mother-s-rules-a-practical-guide-to-becoming-an.pdf
    • http://www.gorillawalker.com/eccentricities.pdf
    • http://www.gorillawalker.com/the-2001-annual-volume-1-training-and-volume-2-consulting.pdf
    • http://www.gorillawalker.com/guide-dogs-informational-nonfiction-animal-behavior-social-studies-unknown-binding.pdf
    • http://www.gorillawalker.com/factors-influencing-the-distribution-of-corals-on-the-reefs-of.pdf
    • http://www.gorillawalker.com/christian-home-educators-curriculum-manual-junior-senior-high-1995-edition.pdf
    • http://www.gorillawalker.com/mountain-redemption-a-christian-historical-romance-woman-of-courage-book.pdf
    • http://www.gorillawalker.com/the-other-clash-of-civilizations-samuel-huntington-and-american-civil.pdf
    • http://www.gorillawalker.com/nag-hammadi-codices-greek-and-coptic-papyri-from-the-cartonnage.pdf
    • http://www.gorillawalker.com/what-is-psychology-essentials.pdf
    • http://www.gorillawalker.com/la-forza-scura-the-dark-force-conductor-score-eighth-note.pdf
    • http://www.gorillawalker.com/hitler-s-mind-a-plunge-into-madness.pdf
    • http://www.gorillawalker.com/nbcfal-choreography-exchange.pdf
    • http://www.gorillawalker.com/supervision-as-collaboration-in-the-human-services-building-a-learning.pdf
    • http://www.gorillawalker.com/office-of-national-marine-sanctuaries-science-review-of-artificial-reefs.pdf
    • http://www.gorillawalker.com/food-from-the-heartland-the-cooking-of-america-s-midwest.pdf
    • http://www.gorillawalker.com/up-to-no-good-the-church-series.pdf
    • http://www.gorillawalker.com/fruits-of-progress-growing-sustainable-farming-and-food-systems.pdf
    • http://www.gorillawalker.com/villa-triste.pdf
    • http://www.gorillawalker.com/the-worship-songbook-volume-1.pdf
    • http://www.gorillawalker.com/bad-fame-poems.pdf
    • http://www.gorillawalker.com/the-ipad-for-photographers-master-the-newest-tool-in-your.pdf
    • http://www.gorillawalker.com/out-of-place-homeless-mobilizations-subcities-and-contested-landscapes.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.