Malicious PDF — malware analysis report

Static analysis result for SHA-256 65abb6ebbcbd4c13…

MALICIOUS

PDF

43.9 KB Created: 2018-12-14 20:00:44 +03:00 Authoring application: dvips 5.83 (MiKTeX 1.20b) Copyright 1998 Radical Eye Software (via Acrobat Distiller 4.0 for Windows)
MD5: 534d013a999b2e7a8a777f74934062f6 SHA-1: 3680ff4e9ec42b9d2c1830f6b235e8c285b5fe3a SHA-256: 65abb6ebbcbd4c131e841923affb35b254ee903f9644ca1db3b039ea5f3e7cbf
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to PDF files on the same domain, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or to distribute a large volume of content, potentially malicious. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8859

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/jai-maa-durga.pdf
    • http://www.gorillawalker.com/night-play-dark-hunter-novels.pdf
    • http://www.gorillawalker.com/sacred-space-the-prayer-book-2015.pdf
    • http://www.gorillawalker.com/early-appearance-of-rabies-virus-in-the-blood-and-in.pdf
    • http://www.gorillawalker.com/little-chicken-finger-puppet-book-little-finger-puppet-board-books.pdf
    • http://www.gorillawalker.com/a-recipe-collection-for-your-wic-food-wic-food-recipes.pdf
    • http://www.gorillawalker.com/machiavelli-for-moms-maxims-on-the-effective-governance-of-children.pdf
    • http://www.gorillawalker.com/hardcore-romeo.pdf
    • http://www.gorillawalker.com/catalogue-of-early-telescopes-istituto-e-museo-di-storia-della.pdf
    • http://www.gorillawalker.com/arabic-vocabulary-cards-arabic-edition.pdf
    • http://www.gorillawalker.com/sap-process-orchestration.pdf
    • http://www.gorillawalker.com/short-bike-rides-in-eastern-massachusetts-3rd-short-bike-rides.pdf
    • http://www.gorillawalker.com/selected-papers-on-algebra-and-topology-by-garrett-birkhoff-contemporary.pdf
    • http://www.gorillawalker.com/selected-poems-of-langston-hughes-vintage-classics.pdf
    • http://www.gorillawalker.com/lean-iso-9001-adding-spark-to-your-iso-9001-qms.pdf
    • http://www.gorillawalker.com/the-law-most-beautiful-and-best-medical-argument-and-magical.pdf
    • http://www.gorillawalker.com/las-recetas-de-norali-mis-recetas-familiares-m.pdf
    • http://www.gorillawalker.com/merry-christmas-rip-a-billy-ingham-adventure-book-3-kindle.pdf
    • http://www.gorillawalker.com/legaia-2-duel-saga-prima-s-official-strategy-guide.pdf
    • http://www.gorillawalker.com/selected-chinese-tales-of-the-han-wei-and-six-dynasties.pdf
    • http://www.gorillawalker.com/exploring-mdx-using-microsoft-sql-server-2012-paperback.pdf
    • http://www.gorillawalker.com/personal-injury-compensation-cases-the-law-applicable-supreme-people-s.pdf
    • http://www.gorillawalker.com/teaching-secondary-school-science-strategies-for-developing-scientific-literacy-9th.pdf
    • http://www.gorillawalker.com/the-1969-envoy-an-annual-pictorial-record-ambassador-college-yearbook.pdf
    • http://www.gorillawalker.com/the-romans-and-their-gods-in-the-age-of-augustus.pdf
    • http://www.gorillawalker.com/state-flowers.pdf
    • http://www.gorillawalker.com/dr-horrible-analni-oralno-bez-obzira-na-glavni-krvavi-sex.pdf
    • http://www.gorillawalker.com/the-vampire-lestat-vampire-chronicles.pdf
    • http://www.gorillawalker.com/playing-with-pleasure-the-players-club-volume-2.pdf
    • http://www.gorillawalker.com/strategies-for-addressing-behavior-problems-in-the-classroom-6th-edition.pdf
    • http://www.gorillawalker.com/organizing-solutions-for-people-with-adhd-2nd-edition-revised-and.pdf
    • http://www.gorillawalker.com/student-study-guide-for-silberberg-chemistry-the-molecular-nature-of.pdf
    • http://www.gorillawalker.com/richard-hughes.pdf
    • http://www.gorillawalker.com/borrowing-heather-s-body-3-body-swap-erotica.pdf
    • http://www.gorillawalker.com/international-copyright-law-u-s-and-e-u-perspectives-text.pdf
    • http://www.gorillawalker.com/abnormal-psychology-6th-edition.pdf
    • http://www.gorillawalker.com/goddess-of-the-glass-vol-1.pdf
    • http://www.gorillawalker.com/the-greatest-civilizations-of-the-americas-the-history-and-culture.pdf
    • http://www.gorillawalker.com/the-layman-s-bible-dictionary-quicknotes-commentaries.pdf
    • http://www.gorillawalker.com/development-oriented-corporate-social-responsibility-volume-1-multinational-corporations-and.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.