Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ea5da9437952a83…

MALICIOUS

PDF

35.0 KB Created: 2019-05-24 00:45:41 +03:00 Authoring application: Adobe Acrobat 6.02 (via Adobe Acrobat 6.02 Paper Capture Plug-in)
MD5: b88ba4b153627b7b648454e330e60464 SHA-1: 34498a74ca207055fc00908874b91c542d8a9157 SHA-256: 5ea5da9437952a8332e4cadf8f12637a6f63474a8f51fcfbf48bea0881554a17
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or distribution mechanism. The ML classifier also flagged the PDF as malicious. While no scripts were extracted, the sheer volume of external links points towards a malicious intent, likely related to SEO manipulation or redirecting users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8018

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/vegetarian-diet-the-complete-vegetarian-diet-plan-vegetarian-diet-cookbook.pdf
    • http://www.gorillawalker.com/david-lachapelle-earth-laughs-in-flowers.pdf
    • http://www.gorillawalker.com/fated.pdf
    • http://www.gorillawalker.com/the-miracles-of-jesus-meditations-and-prayers-for-lent.pdf
    • http://www.gorillawalker.com/tex-ritter-america-s-most-beloved-cowboy.pdf
    • http://www.gorillawalker.com/understanding-the-scandinavian.pdf
    • http://www.gorillawalker.com/seize-the-story-a-handbook-for-teens-who-like-to.pdf
    • http://www.gorillawalker.com/sentences-magic-of-language.pdf
    • http://www.gorillawalker.com/blues-harp-der-einfache-weg-zum-blues-spiel-auf-der.pdf
    • http://www.gorillawalker.com/sergeant-major-u-s-marines-the-biogrgaphy-of-sergeant-major.pdf
    • http://www.gorillawalker.com/a-difficult-woman-the-challenging-life-and-times-of-lillian.pdf
    • http://www.gorillawalker.com/citizenship-and-its-discontents-an-indian-history.pdf
    • http://www.gorillawalker.com/opseis-riflessi-in-uno-specchio-frantumato-italian-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/the-illustrated-kama-sutra-ananga-ranga-and-perfumed-garden-the.pdf
    • http://www.gorillawalker.com/national-gallery-catalogues-the-sixteenth-century-italian-paintings-volume-1.pdf
    • http://www.gorillawalker.com/jamaica-and-the-greater-antilles-crowood-travel-guides.pdf
    • http://www.gorillawalker.com/testing-and-diagnosis-of-analog-circuits-and-systems-electrical-engineering.pdf
    • http://www.gorillawalker.com/serpents-in-the-cold-the-boston-saga.pdf
    • http://www.gorillawalker.com/blue-monday-fats-domino-and-the-lost-dawn-of-rock.pdf
    • http://www.gorillawalker.com/the-dunwich-horror-and-others-the-best-supernatural-stories-of.pdf
    • http://www.gorillawalker.com/caught-up-into-heaven.pdf
    • http://www.gorillawalker.com/tornadoes-the-natural-disasters-series-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/amish-romance-boxed-set-five-amish-romance-books-clean-romance.pdf
    • http://www.gorillawalker.com/sensors-update-vol-10.pdf
    • http://www.gorillawalker.com/himalaya-to-the-sea-geology-geomorphology-and-the-quaternary.pdf
    • http://www.gorillawalker.com/elementary-statistics-a-step-by-step-approach-custom-edition-for.pdf
    • http://www.gorillawalker.com/the-basher-science-the-periodic-table-digital.pdf
    • http://www.gorillawalker.com/lost-summer.pdf
    • http://www.gorillawalker.com/the-amazing-fact-of-quaker-worship-swarthmore-lecture.pdf
    • http://www.gorillawalker.com/the-relationship-between-total-cloud-lightning-behavior-and-radar-derived.pdf
    • http://www.gorillawalker.com/strategies-for-building-academic-vocabulary-in-science.pdf
    • http://www.gorillawalker.com/new-testament-interpretation-through-rhetorical-criticism-studies-in-religion.pdf
    • http://www.gorillawalker.com/u-s-latino-literature-a-critical-guide-for-students-and.pdf
    • http://www.gorillawalker.com/estimating-and-tendering-in-construction-work-second-edition.pdf
    • http://www.gorillawalker.com/the-economics-and-politics-of-race-an-international-perspective.pdf
    • http://www.gorillawalker.com/junk-bonds-how-high-yield-securities-restructured-corporate-america.pdf
    • http://www.gorillawalker.com/denver-broncos-2015-calendar-min-wal-calendar.pdf
    • http://www.gorillawalker.com/arrl-s-low-power-communications-the-art-and-science-of.pdf
    • http://www.gorillawalker.com/the-deadliest-earthling-the-aldrinverse-volume-1.pdf
    • http://www.gorillawalker.com/20-years-apart.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.