Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ad8510458600854…

MALICIOUS

PDF

42.7 KB Created: 2018-11-26 08:34:22 +03:00 Authoring application: - (via OpenOffice.org 2.2)
MD5: 979b3e4a33226969b32e0d390394f945 SHA-1: 96cd64060cd707b9574d4e9852eda8aa928ed453 SHA-256: 6ad851045860085402d395b4e984a755115dd631d370f4ce83450640c599e243
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While no scripts were explicitly extracted, the ML_NYX_PDF_MALICIOUS heuristic indicates a high probability of malicious intent. The embedded URLs suggest a potential attempt to manipulate search engine rankings or redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/usmle-pharmacology-review-flash-cards.pdf
    • http://www.gorillawalker.com/escape-from-codependent-christianity.pdf
    • http://www.gorillawalker.com/il-tempio-italian-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/myfinancelab-with-pearson-etext-access-card-for-multinational-business-finance.pdf
    • http://www.gorillawalker.com/colonial-slavery-defence-of-the-baptist-missionaries-from-the-charge.pdf
    • http://www.gorillawalker.com/diagnosis-made-easier-principles-and-techniques-for-mental-health-clinicians.pdf
    • http://www.gorillawalker.com/the-official-beckett-price-guide-to-basketball-cards-2006-edition.pdf
    • http://www.gorillawalker.com/a-warm-welcome-how-to-be-a-gracious-host-to.pdf
    • http://www.gorillawalker.com/worlds-greatest-collection-of-clean-jokes.pdf
    • http://www.gorillawalker.com/wiley-cia-exam-review-focus-notes-internal-audit-practice-part.pdf
    • http://www.gorillawalker.com/fourth-grade-common-core-workbook-math-activities-volume-2-of.pdf
    • http://www.gorillawalker.com/bruma-de-medianoche-romantica-paranormal-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/stallcup-s-osha-and-nfpa-70e-electrical-regulations-simplified.pdf
    • http://www.gorillawalker.com/jane-s-workplace-security-handbook.pdf
    • http://www.gorillawalker.com/illustrated-dictionary-of-historic-architecture-dover-architecture.pdf
    • http://www.gorillawalker.com/asclepius-a-secret-discourse-of-hermes-trismegistus-kindle-edition.pdf
    • http://www.gorillawalker.com/princess-ka-iulani-women-of-spirit.pdf
    • http://www.gorillawalker.com/living-like-jesus-basic-kit-ages-2-4-jr-kids.pdf
    • http://www.gorillawalker.com/desarrollo-web-con-php-y-mysql-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/boys-at-the-alphabet-ball.pdf
    • http://www.gorillawalker.com/buffy-the-vampire-slayer-vol-5-pale-reflections.pdf
    • http://www.gorillawalker.com/yellowstone-its-underworld-geology-historical-anecdotes-of-our-oldest-national.pdf
    • http://www.gorillawalker.com/saetas-de-versos-laicos-spanish-edition.pdf
    • http://www.gorillawalker.com/clinical-cases-in-restorative-and-reconstructive-dentistry.pdf
    • http://www.gorillawalker.com/mental-disorders-medications-and-clinical-social-work-3rd-third-edition.pdf
    • http://www.gorillawalker.com/simple-german-cookery.pdf
    • http://www.gorillawalker.com/health-and-health-care-in-the-nation-s-prisons-issues.pdf
    • http://www.gorillawalker.com/accidental-seal-seal-brotherhood-series-book-1.pdf
    • http://www.gorillawalker.com/a-grammar-of-the-arabic-language-wright-s-grammar-vol.pdf
    • http://www.gorillawalker.com/home-health-aide-on-the-go-in-service-lessons-vol.pdf
    • http://www.gorillawalker.com/the-situational-leader-the-other-59-minutes.pdf
    • http://www.gorillawalker.com/ginger-my-story.pdf
    • http://www.gorillawalker.com/college-of-civil-engineering-and-architecture-engineering-textbook-series-finite.pdf
    • http://www.gorillawalker.com/ice-cream-social-the-struggle-for-the-soul-of-ben.pdf
    • http://www.gorillawalker.com/guinness-the-250-year-quest-for-the-perfect-pint.pdf
    • http://www.gorillawalker.com/happy-school-year.pdf
    • http://www.gorillawalker.com/15-very-easy-hymns-alto-sax-book-cd.pdf
    • http://www.gorillawalker.com/here-i-am-lord-a-prayer-journal-for-teens-v.pdf
    • http://www.gorillawalker.com/bowling-sport-for-life-series.pdf
    • http://www.gorillawalker.com/dada-s-women.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.