Malicious PDF — malware analysis report

Static analysis result for SHA-256 672881a823e1c3d3…

MALICIOUS

PDF

42.3 KB Created: 2018-11-14 10:41:48 +03:00 Authoring application: Adobe Illustrator CS2 (via Adobe PDF library 7.77)
MD5: e820a6e8ef31f76766d687e458007be6 SHA-1: 8c3f7fba25c5fc3facd1ced0eee0e3356b4d5afe SHA-256: 672881a823e1c3d3adf250eba9d1beb4c24b4099332a1445921d8330a1d29fe2
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The embedded URLs likely serve as a link farm for SEO manipulation or to distribute additional malicious content, rather than providing direct user value.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8469

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/h-m-s-surprise-aubrey-maturin-series-book-3.pdf
    • http://www.gorillawalker.com/everyday-british-the-heart-healthy-way-to-make-your-favourite.pdf
    • http://www.gorillawalker.com/here-we-go-god-s-roadmap-for-you.pdf
    • http://www.gorillawalker.com/one-eyed-dick-nellie-the-whore-and-the-spring-of.pdf
    • http://www.gorillawalker.com/primeros-auxilios-spanish-edition.pdf
    • http://www.gorillawalker.com/the-atp-tour-ten-years-of-superstar-tennis.pdf
    • http://www.gorillawalker.com/knowledge-representation-and-reasoning-the-morgan-kaufmann-series-in-artificial.pdf
    • http://www.gorillawalker.com/running-vienna-running-the-eu-book-25-kindle-edition.pdf
    • http://www.gorillawalker.com/basin-analysis-principles-and-application-to-petroleum-play-assessment-kindle.pdf
    • http://www.gorillawalker.com/a-dictionary-of-practical-materia-medica-3-volume-set.pdf
    • http://www.gorillawalker.com/ethics-for-public-managers.pdf
    • http://www.gorillawalker.com/soulstealers-the-chinese-sorcery-scare-of-1768.pdf
    • http://www.gorillawalker.com/designing-dendrimers.pdf
    • http://www.gorillawalker.com/roads-to-geometry-2nd-edition.pdf
    • http://www.gorillawalker.com/andalusia.pdf
    • http://www.gorillawalker.com/separated-at-birth-2.pdf
    • http://www.gorillawalker.com/hooked-an-amateur-s-guide-to-the-golf-courses-of.pdf
    • http://www.gorillawalker.com/decoys-inc.pdf
    • http://www.gorillawalker.com/tcm-case-studies-pain-management.pdf
    • http://www.gorillawalker.com/wuthering-nights-an-erotic-retelling-of-wuthering-heights-kindle-edition.pdf
    • http://www.gorillawalker.com/handbook-of-boolean-algebras-volume-2.pdf
    • http://www.gorillawalker.com/how-freud-worked.pdf
    • http://www.gorillawalker.com/connecting-teachers-students-and-standards-strategies-for-success-in-diverse.pdf
    • http://www.gorillawalker.com/harvard-business-review-on-brand-management-harvard-business-review-paperback.pdf
    • http://www.gorillawalker.com/public-spectacles-in-roman-and-late-antique-palestine-revealing-antiquity.pdf
    • http://www.gorillawalker.com/manual-de-neonatologia-spanish-edition.pdf
    • http://www.gorillawalker.com/tools-and-their-uses-dover-books-for-the-handyman.pdf
    • http://www.gorillawalker.com/the-laboratory-handbook-of-materials-equipment-and-technique.pdf
    • http://www.gorillawalker.com/brazos-carry-me.pdf
    • http://www.gorillawalker.com/u-s-security-assistance-to-lebanon-kindle-edition.pdf
    • http://www.gorillawalker.com/2013-california-residential-code-title-24-part-2-5.pdf
    • http://www.gorillawalker.com/above-the-gravel-bar-the-native-canoe-routes-of-maine.pdf
    • http://www.gorillawalker.com/practical-rhinology.pdf
    • http://www.gorillawalker.com/chemical-applications-of-thermal-neutron-scattering-harwell-post-graduate.pdf
    • http://www.gorillawalker.com/billy-sunday-the-man-and-his-message-american-evangelist-series.pdf
    • http://www.gorillawalker.com/the-catholic-youth-prayer-book-second-edition.pdf
    • http://www.gorillawalker.com/john-muir-america-s-naturalist-images-of-conservationists.pdf
    • http://www.gorillawalker.com/test-your-communications-master-bridge-series.pdf
    • http://www.gorillawalker.com/by-k-hostettmann-andrew-marston-maryse-hostettmann-preparative-chromatography-techniques.pdf
    • http://www.gorillawalker.com/buddy-the-first-seeing-eye-dog-turtleback-school-library-binding.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.