Malicious PDF — malware analysis report

Static analysis result for SHA-256 647a1f657202a3ae…

MALICIOUS

PDF

43.6 KB Created: 2018-11-23 20:55:25 +03:00 Authoring application: FrameMaker 6.0 (via Acrobat Distiller 6.0.1 for Macintosh)
MD5: 3078a684834358ba631caf732dd322ed SHA-1: 0ecc3518834e19c8843221c809a83daee7dfa5f2 SHA-256: 647a1f657202a3ae9190e38e475dfb35d58d76e6bf9203620e6ce64b31cd5673
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The embedded URLs point to a single domain, suggesting a coordinated effort to distribute content or manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8859

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/sleeping-chez-sade-fantasy-playland-book-2.pdf
    • http://www.gorillawalker.com/gris-grimly-s-wicked-nursery-rhymes.pdf
    • http://www.gorillawalker.com/the-little-red-book-of-kitchen-wisdom-little-red-books.pdf
    • http://www.gorillawalker.com/el-detective-ausente-the-absent-detective-spanish-edition.pdf
    • http://www.gorillawalker.com/find-the-seashell-elmo-s-world-3.pdf
    • http://www.gorillawalker.com/generalized-functions-theory-and-applications.pdf
    • http://www.gorillawalker.com/black-defilement-volume-1-interracial-cuckold-erotica-collection-kindle-edition.pdf
    • http://www.gorillawalker.com/blessings-of-the-manger-leader-an-advent-study-based-on.pdf
    • http://www.gorillawalker.com/aprende-a-hablar-a-mama-spanish-edition.pdf
    • http://www.gorillawalker.com/johannes-brahms-violin-sonata-no-3-op-108-a-score.pdf
    • http://www.gorillawalker.com/la-magia-egipcia.pdf
    • http://www.gorillawalker.com/star-wars-death-star-owner-s-technical-manual-imperial-ds.pdf
    • http://www.gorillawalker.com/my-mother-the-detective-the-complete-mom-short-stories.pdf
    • http://www.gorillawalker.com/write-your-own-business-contracts-what-your-attorney-won-t.pdf
    • http://www.gorillawalker.com/after-the-green-revolution-sustainable-agriculture-for-development-natural-resource.pdf
    • http://www.gorillawalker.com/basic-leathercrafting-all-the-skills-and-tools-you-need-to.pdf
    • http://www.gorillawalker.com/la-guerre-des-algeriens-ecrits-1956-1963-collection-debats-french.pdf
    • http://www.gorillawalker.com/transformers-target-2006-transformers-titan-books-paperback.pdf
    • http://www.gorillawalker.com/gre-lsat-logic-workbook-arco-academic-test-preparation-series.pdf
    • http://www.gorillawalker.com/bohm-carl-moto-perpetuo-from-suite-iii-no-6-for.pdf
    • http://www.gorillawalker.com/hilary-duff-life-in-the-spotlight-hot-celebrity-biographies.pdf
    • http://www.gorillawalker.com/dampers-and-airflow-control.pdf
    • http://www.gorillawalker.com/milkman-murders.pdf
    • http://www.gorillawalker.com/exposed-a-history-of-lingerie.pdf
    • http://www.gorillawalker.com/gendering-europeanisation-series-multiple-europes.pdf
    • http://www.gorillawalker.com/toddlers-and-twos-bible-story-picture-cards-fall-quarter.pdf
    • http://www.gorillawalker.com/baby-foxes-it-s-fun-to-learn-about-baby-animals.pdf
    • http://www.gorillawalker.com/the-commercialization-of-next-generation-sequencing-solving-complexity-through-rapid.pdf
    • http://www.gorillawalker.com/alfred-s-basic-adult-piano-course-lesson-book-bk-1.pdf
    • http://www.gorillawalker.com/cobbett-s-cyclopedic-survey-of-chamber-music-vol-2-l.pdf
    • http://www.gorillawalker.com/british-piston-aero-engines.pdf
    • http://www.gorillawalker.com/insurgent-iraq-al-zarqawi-and-the-new-generation.pdf
    • http://www.gorillawalker.com/personality-puzzle.pdf
    • http://www.gorillawalker.com/north-american-sea-life-troubadour.pdf
    • http://www.gorillawalker.com/let-s-be-scientists-authentic-learning-in-the-science-classroom.pdf
    • http://www.gorillawalker.com/the-attractive-story-of-magnetism-with-max-axiom-super-scientist.pdf
    • http://www.gorillawalker.com/make-money-online-7-steps-to-make-money-at-home.pdf
    • http://www.gorillawalker.com/mid-victorian-britain-1851-75.pdf
    • http://www.gorillawalker.com/istanbul-colors-of-the-city.pdf
    • http://www.gorillawalker.com/invertebrate-tissue-culture-v-1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.