Malicious PDF — malware analysis report

Static analysis result for SHA-256 6566218bf249848b…

MALICIOUS

PDF

40.3 KB Created: 2018-12-07 18:28:44 +03:00 Authoring application: Writer (via OpenOffice.org 2.4)
MD5: 6491b894ebdd1794f4a725e0fb217e9f SHA-1: e037efb3305b034115a91e356af59f02fedd4505 SHA-256: 6566218bf249848beafe04c887536cfa3379e12e50125fbaec3d909cbcc29017
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a website hosting numerous PDFs, potentially for SEO spam or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/pythagoras-secret-code-see-and-hear-how-number-shape-and.pdf
    • http://www.gorillawalker.com/aerodynamic-theory-a-general-review-of-progress-vol-v-divisions.pdf
    • http://www.gorillawalker.com/2015-supercoder-illustrated-for-neurology-neurosurgery.pdf
    • http://www.gorillawalker.com/visitors-oberon-modern-plays.pdf
    • http://www.gorillawalker.com/the-aids-fact-book.pdf
    • http://www.gorillawalker.com/my-blue-busy-book.pdf
    • http://www.gorillawalker.com/requiem-a-tale-of-exile-and-return.pdf
    • http://www.gorillawalker.com/five-english-reformers.pdf
    • http://www.gorillawalker.com/the-magic-horse-of-han-gan.pdf
    • http://www.gorillawalker.com/to-err-is-azrin-mission-4-black-ocean-kindle-edition.pdf
    • http://www.gorillawalker.com/charlie-chan-carries-on-a-charlie-chan-mystery-charlie-chan.pdf
    • http://www.gorillawalker.com/by-jack-t-marchewka-information-technology-project-management-third-3rd.pdf
    • http://www.gorillawalker.com/unmasked-volume-1.pdf
    • http://www.gorillawalker.com/meat-cook-s-kitchen-reference.pdf
    • http://www.gorillawalker.com/an-introduction-to-abstract-mathematics.pdf
    • http://www.gorillawalker.com/finish-first-an-interactive-guide-to-finding-and-following-your.pdf
    • http://www.gorillawalker.com/stone-hard-seals-a-duet-of-steamy-seal-romance.pdf
    • http://www.gorillawalker.com/college-grad-job-hunter-insider-techniques-and-tactics-for-finding.pdf
    • http://www.gorillawalker.com/frenchmans-cap-story-of-a-mountain.pdf
    • http://www.gorillawalker.com/liner-fifty-years-of-passenger-ship-photographs.pdf
    • http://www.gorillawalker.com/christianity-vs-islam-a-muslim-and-a-christian-debate-6.pdf
    • http://www.gorillawalker.com/epica-de-san-sebastian-del-pepino-spanish-edition.pdf
    • http://www.gorillawalker.com/an-inside-look-at-america-s-teams-meet-the-women.pdf
    • http://www.gorillawalker.com/solar-energy-for-the-terrestrial-generation-of-electricity-hearing-ninety.pdf
    • http://www.gorillawalker.com/word-play-for-kids-super-fun.pdf
    • http://www.gorillawalker.com/andante-e-rondo-ongarese-op-35-version-for-bassoon-and.pdf
    • http://www.gorillawalker.com/mind-trek-exploring-consciousness-time-and-space-through-remote-viewing.pdf
    • http://www.gorillawalker.com/rocket-dynamics-and-space-flight.pdf
    • http://www.gorillawalker.com/the-cardinal-part-one.pdf
    • http://www.gorillawalker.com/the-healthy-for-life-cookbook.pdf
    • http://www.gorillawalker.com/a-reference-grammar-of-modern-standard-arabic-reference-grammars.pdf
    • http://www.gorillawalker.com/gok-s-wok.pdf
    • http://www.gorillawalker.com/raleigh-city-slicker.pdf
    • http://www.gorillawalker.com/teton-sioux-music-and-culture.pdf
    • http://www.gorillawalker.com/the-holmes-manual.pdf
    • http://www.gorillawalker.com/the-oxford-companion-to-wine-3rd-edition.pdf
    • http://www.gorillawalker.com/dark-moods-paperback.pdf
    • http://www.gorillawalker.com/uke-tabs-for-beginner-what-child-is-this-greensleeves-key.pdf
    • http://www.gorillawalker.com/american-history-by-era-prosperity-depression-and-war-1920-1945.pdf
    • http://www.gorillawalker.com/glbtq-the-survival-guide-for-queer-and-questioning-teens.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.