Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f7d51f17a82caa3…

MALICIOUS

PDF

42.3 KB Created: 2019-03-17 10:52:29 +03:00 Authoring application: - (via Acrobat Distiller 4.05 for Windows)
MD5: 8daabcf040148706a06b0842f5a30973 SHA-1: bbb79f70706324a944adaa80d8e14f8a792dbd29 SHA-256: 5f7d51f17a82caa375d4fdb733f541b3ba5e6e349af2ef97059721eaacabacc9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on the same domain. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/real-world-decision-making-an-encyclopedia-of-behavioral-economics.pdf
    • http://www.gorillawalker.com/stockholm-sights-2011-a-travel-guide-to-the-top-45.pdf
    • http://www.gorillawalker.com/venture-capital-journal-1983-yearbook.pdf
    • http://www.gorillawalker.com/el-viaje-en-tren-spanish-edition.pdf
    • http://www.gorillawalker.com/what-ho-magic.pdf
    • http://www.gorillawalker.com/una-temporada-en-el-infierno-iluminaciones-literatura-literature-spanish-edition.pdf
    • http://www.gorillawalker.com/lecture-supplement-temporomandibular-joint-dysfunction-with-or-without-functional-occlusion.pdf
    • http://www.gorillawalker.com/bear-s-boats.pdf
    • http://www.gorillawalker.com/beyond-buds-marijuana-extracts-151-hash-vaping-dabbing-edibles-and.pdf
    • http://www.gorillawalker.com/say-hello.pdf
    • http://www.gorillawalker.com/sociology-of-the-american-indian.pdf
    • http://www.gorillawalker.com/101-trava-l.pdf
    • http://www.gorillawalker.com/visit-independence-hall-landmarks-of-liberty-gareth-stevens.pdf
    • http://www.gorillawalker.com/continuing-professional-development-a-practical-guide-for-teachers-and-schools.pdf
    • http://www.gorillawalker.com/the-women-alive-project-pursuing-intimacy-with-jesus.pdf
    • http://www.gorillawalker.com/cardima-inc-cadm-product-pipeline-analysis-download-pdf-digital.pdf
    • http://www.gorillawalker.com/tai-chi-chuan-martial-power-advanced-yang-style-new-user.pdf
    • http://www.gorillawalker.com/college-algebra-an-early-functions-approach-2nd-edition.pdf
    • http://www.gorillawalker.com/mozart-missa-c-minor-kv-427-417a-piano-score-edition.pdf
    • http://www.gorillawalker.com/on-exchange-an-adjudicative-commentary-sources-in-early-modern-economics.pdf
    • http://www.gorillawalker.com/student-cd-for-milady-s-standard-nail-technology-individual-version.pdf
    • http://www.gorillawalker.com/the-shotgunner.pdf
    • http://www.gorillawalker.com/tainted-kiss-the-watcher-s-kiss-series-volume-1.pdf
    • http://www.gorillawalker.com/lapstrake-canoes-everything-you-need-to-know-to-build-a.pdf
    • http://www.gorillawalker.com/three-fanfares-fanfare-no-3-no-4-and-no-5.pdf
    • http://www.gorillawalker.com/tx-noncompliance-not-uncommon-in-psoriasis-despite-patient-s-claims.pdf
    • http://www.gorillawalker.com/sefer-hanetina-pitchu-et-hadelet-lachaim-shel-netina-hebrew-edition.pdf
    • http://www.gorillawalker.com/out-of-action.pdf
    • http://www.gorillawalker.com/life-of-pi.pdf
    • http://www.gorillawalker.com/still-here-forever-book-1-of-the-neuron-doctrine-series.pdf
    • http://www.gorillawalker.com/douglas-dc-3-the-survivors.pdf
    • http://www.gorillawalker.com/compressors-and-compressed-air-systems-quick-book.pdf
    • http://www.gorillawalker.com/alpine-circus-a-skier-s-exotic-adventures-at-the-snowy.pdf
    • http://www.gorillawalker.com/sap-r-3-implementation-with-asap-the-official-sap-guide.pdf
    • http://www.gorillawalker.com/imaging-for-students-third-edition-lisle-imaging-for-students.pdf
    • http://www.gorillawalker.com/sponge-balls-volume-9-of-the-magic-city-library-of.pdf
    • http://www.gorillawalker.com/medifocus-guidebook-on-erectile-dysfunction.pdf
    • http://www.gorillawalker.com/unprotected-with-my-friend-s-daughter-older-man-younger-woman.pdf
    • http://www.gorillawalker.com/biological-indicators-of-freshwater-pollution-and-environmental-management-pollution-monitoring.pdf
    • http://www.gorillawalker.com/bibliography-of-the-international-court-of-justice-1993-english-and.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.