Malicious PDF — malware analysis report

Static analysis result for SHA-256 67ef2a415a3c8f09…

MALICIOUS

PDF

41.4 KB Created: 2019-03-16 18:14:14 +03:00 Authoring application: Acrobat PDFMaker 7.0 для Word (via Acrobat Distiller 7.0.5 (Windows))
MD5: 1c02fbedb9a015c3236eb7b782fde5a8 SHA-1: 02c3a9e780988ffdab6da3a8d05079d605db9266 SHA-256: 67ef2a415a3c8f09f8ee219e3bb86e04d8157adbd3d47c710e09fa6a5e7b4872
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be the creation of a link farm, potentially for SEO manipulation or to serve as a distribution point for other malicious content, rather than direct user interaction with the current document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/francisco-franco.pdf
    • http://www.gorillawalker.com/amazing-studies-clarinet.pdf
    • http://www.gorillawalker.com/gymnastics-training-and-fitness.pdf
    • http://www.gorillawalker.com/andeliga-s-nger-swedish-edition.pdf
    • http://www.gorillawalker.com/starting-up-do-you-have-what-it-takes-to-make.pdf
    • http://www.gorillawalker.com/moving-to-and-around-toronto-and-area-fall-winter.pdf
    • http://www.gorillawalker.com/shepherd-s-pipe-carol-satb-vocal-score.pdf
    • http://www.gorillawalker.com/vulnerability-to-poverty-theory-measurement-and-determinants-with-case-studies.pdf
    • http://www.gorillawalker.com/protecting-controlling-and-monetizing-assets-in-dispute-a-practical-guide.pdf
    • http://www.gorillawalker.com/galactic-empire-wars-emergence-the-galactic-empire-wars-book-2.pdf
    • http://www.gorillawalker.com/anwar-sadat-mwl-major-world-leaders.pdf
    • http://www.gorillawalker.com/the-unfaithful-queen-a-novel-of-henry-viii-s-fifth.pdf
    • http://www.gorillawalker.com/press-on-choral-octavo-choir-words-and-music-by-dan.pdf
    • http://www.gorillawalker.com/the-tendency-of-history-with-the-foreign-trade-of-the.pdf
    • http://www.gorillawalker.com/the-cave-and-the-code-deluxe-edition-aphorism-volume-1.pdf
    • http://www.gorillawalker.com/travel-journal-my-trip-to-key-west.pdf
    • http://www.gorillawalker.com/rethinking-engineering-education-the-cdio-approach.pdf
    • http://www.gorillawalker.com/language-reference-for-business-english-business-management-english.pdf
    • http://www.gorillawalker.com/the-hitler-werewolf-murders.pdf
    • http://www.gorillawalker.com/fascia-the-tensional-network-of-the-human-body-the-science.pdf
    • http://www.gorillawalker.com/statics-exam-file-exam-file-series.pdf
    • http://www.gorillawalker.com/seal-o-san-basketball-shot-charts-and-scouting-diagrams-for.pdf
    • http://www.gorillawalker.com/tempest-the-masterstudies.pdf
    • http://www.gorillawalker.com/the-forgiveness-of-jesus-participant-s-guide-six-in-depth.pdf
    • http://www.gorillawalker.com/english-episcopal-acta-20-york-1154-1181.pdf
    • http://www.gorillawalker.com/combat-mission-barbarossa-to-berlin-strategy-guide.pdf
    • http://www.gorillawalker.com/selected-poems-modern-european-poets.pdf
    • http://www.gorillawalker.com/berlin-days-1946-47.pdf
    • http://www.gorillawalker.com/trials-and-tribulations-of-depression-haiku-quotes-and-thoughts-of.pdf
    • http://www.gorillawalker.com/caged-talented-saga-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/epidemiology-and-statistics-for-the-ophthalmologist.pdf
    • http://www.gorillawalker.com/how-terrorism-ends-understanding-the-decline-and-demise-of-terrorist.pdf
    • http://www.gorillawalker.com/bereavement-bible-readings-for-special-times.pdf
    • http://www.gorillawalker.com/60-division-worksheets-with-3-digit-dividends-3-digit-divisors.pdf
    • http://www.gorillawalker.com/mel-bay-licks-and-tricks-volume2.pdf
    • http://www.gorillawalker.com/flow-the-psychology-of-optimal-experience-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/the-hidden-welfare-state-tax-expenditures-and-social-policy-in.pdf
    • http://www.gorillawalker.com/the-meters-of-old-norse-eddic-poetry-erganzungsbande-zum-reallexikon.pdf
    • http://www.gorillawalker.com/two-sided-matching-a-study-in-game-theoretic-modeling-and.pdf
    • http://www.gorillawalker.com/beloved-stranger.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.