Malicious PDF — malware analysis report

Static analysis result for SHA-256 694c0d643763702e…

MALICIOUS

PDF

35.4 KB Created: 2019-09-02 22:00:19 +03:00 Authoring application: pdftk 1.44 - www.pdftk.com (via itext-paulo-155 (itextpdf.sf.net-lowagie.com))
MD5: 27f419a7903791bbebe9bfb7b31f8546 SHA-1: 7760836ef6ec28154131d643d9ff1d84818cf0f2 SHA-256: 694c0d643763702e4d1b0989be8f1feb12705bba544b8fdcd71525d2a3ad5eaa
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests the document is designed to redirect users to a website hosting numerous files, potentially for malicious purposes such as SEO manipulation or distributing further malware. The ML classifier also flagged the document as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8018

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/past-and-present-secrets-of-the-wohlford-mansion.pdf
    • http://www.gorillawalker.com/cuauht-moc-historia-spanish-edition.pdf
    • http://www.gorillawalker.com/l-arte-italiana-a-parigi-nell-esposizione-universale-del-1867.pdf
    • http://www.gorillawalker.com/spice-up-your-photos-creative-photography-techniques-to-put-a.pdf
    • http://www.gorillawalker.com/texocalypse-now-digger-volume-1.pdf
    • http://www.gorillawalker.com/guide-to-fossil-man-a-handbook-of-human-palaeontology-by.pdf
    • http://www.gorillawalker.com/along-our-side-of-the-mexican-border.pdf
    • http://www.gorillawalker.com/dining-on-a-dime-cook-book-1000-money-saving-recipes.pdf
    • http://www.gorillawalker.com/code-of-federal-regulations-title-37-patents-trademarks-and-copyrights.pdf
    • http://www.gorillawalker.com/pea-soup-andersen-s-scandinavian-american-cookbook.pdf
    • http://www.gorillawalker.com/s-wasserflora-von-mitteleuropa-bd-21-1-freshwater-flora-of.pdf
    • http://www.gorillawalker.com/erster-kreuzzug-und-ethnogenese-in-novam-formam-commutatus-ethnogenetische-prozesse.pdf
    • http://www.gorillawalker.com/canadian-politics-concise.pdf
    • http://www.gorillawalker.com/schoolhouse-rock-medley-satb.pdf
    • http://www.gorillawalker.com/the-woodshed-mystery-the-boxcar-children-mysteries-7.pdf
    • http://www.gorillawalker.com/national-geographic-readers-turtles.pdf
    • http://www.gorillawalker.com/the-trouble-with-secrets.pdf
    • http://www.gorillawalker.com/model-vegan-on-weightloss-how-i-went-from-a-size.pdf
    • http://www.gorillawalker.com/a-book-of-remarkable-criminals.pdf
    • http://www.gorillawalker.com/damron-2010-men-s-travel-guide-damron-men-s-travel.pdf
    • http://www.gorillawalker.com/nigerian-oil-and-gas-case-law-reports-2007-2008-v.pdf
    • http://www.gorillawalker.com/comer-bien-a-diario-recetas-f.pdf
    • http://www.gorillawalker.com/medicare-administrative-appeals.pdf
    • http://www.gorillawalker.com/100-foods-to-stay-young.pdf
    • http://www.gorillawalker.com/tired-of-london-tired-of-life-one-thing-a-day.pdf
    • http://www.gorillawalker.com/martin-luther-king-jr-judged-by-his-character-not-his.pdf
    • http://www.gorillawalker.com/kids-travel-journal-my-trip-to-budapest.pdf
    • http://www.gorillawalker.com/suzuki-viola-school-volume-5-book.pdf
    • http://www.gorillawalker.com/securities-regulation-10th-ed-2007-case-supplement-university-casebooks.pdf
    • http://www.gorillawalker.com/trophy-blacktails-the-science-of-the-hunt.pdf
    • http://www.gorillawalker.com/prince-of-tennis-volume-3.pdf
    • http://www.gorillawalker.com/fodor-s-the-complete-guide-to-african-safaris-with-south.pdf
    • http://www.gorillawalker.com/world-war-one-a-layman-s-guide.pdf
    • http://www.gorillawalker.com/marine-raiders-strike-back-blood-war-book-2.pdf
    • http://www.gorillawalker.com/those-who-heard-it-first-the-political-implications-of-the.pdf
    • http://www.gorillawalker.com/cases-on-management-and-organizational-behavior-in-an-arab-context.pdf
    • http://www.gorillawalker.com/the-sick-rose-disease-and-the-art-of-medical-illustration.pdf
    • http://www.gorillawalker.com/ford-focus-01-05-service-and-repair-manual.pdf
    • http://www.gorillawalker.com/instructor-s-resource-manual-with-chapter-tests-college-algebra-college.pdf
    • http://www.gorillawalker.com/ripe-for-resolution-conflict-and-intervention-in-africa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.