Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c395d54da440f05…

MALICIOUS

PDF

47.1 KB Created: 2019-01-06 08:24:34 +03:00 Authoring application: LaTeX with hyperref package (via pdfeTeX-1.10b)
MD5: 8ff7b8262b1c56f3f96d1e8ac3c6108d SHA-1: 53bf709c7ffd564d03645d7c042ead3320fc348c SHA-256: 6c395d54da440f051f6c7932c9aea7c689c9f160b4e3fef2ff35d1709c84ed44
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be the creation of a link farm, likely to manipulate search engine rankings or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/seashores-peterson-field-guide-color-in-books.pdf
    • http://www.gorillawalker.com/in-the-laurels-caught-fence-modern-poets-series.pdf
    • http://www.gorillawalker.com/ultrafast-photophysics-and-photochemistry-of-radical-precursors-in-solution.pdf
    • http://www.gorillawalker.com/healthy-hair-look-after-yourself.pdf
    • http://www.gorillawalker.com/field-guide-to-the-amphibians-and-reptiles-of-bali.pdf
    • http://www.gorillawalker.com/non-auditory-effects-of-noise-at-work-a-review-of.pdf
    • http://www.gorillawalker.com/snail-and-the-whale.pdf
    • http://www.gorillawalker.com/become-an-idea-machine-because-ideas-are-the-currency-of.pdf
    • http://www.gorillawalker.com/the-biology-and-conservation-of-wild-felids.pdf
    • http://www.gorillawalker.com/event-related-potentials-in-adolescents-with-combined-adhd-and-cd.pdf
    • http://www.gorillawalker.com/eureka-math-a-story-of-functions-algebra-i-module-4.pdf
    • http://www.gorillawalker.com/doctors-los-doctores-tools-we-use-instrumentos-de-trabajo.pdf
    • http://www.gorillawalker.com/china-s-assertive-nuclear-posture-state-security-in-an-anarchic.pdf
    • http://www.gorillawalker.com/the-american-revolution-the-american-adventure-series-11.pdf
    • http://www.gorillawalker.com/baritone-b-c-student-student-instrumental-course-level-two-intermediate.pdf
    • http://www.gorillawalker.com/usaf-damage-tolerant-design-handbook-guidelines-for-the-analysis-and.pdf
    • http://www.gorillawalker.com/small-area-atlas-of-bangladesh-mauzas-and-mahallahs-of-sylhet.pdf
    • http://www.gorillawalker.com/travell-simons-myofascial-pain-and-dysfunction-the-trigger-point-manual.pdf
    • http://www.gorillawalker.com/st-benedict-hero-of-the-hills-vision-books.pdf
    • http://www.gorillawalker.com/social-media-in-travel-tourism-and-hospitality-theory-practice-and.pdf
    • http://www.gorillawalker.com/holt-geometry-premier-online-edition-6-year-geometry-2007.pdf
    • http://www.gorillawalker.com/insider-s-guide-florida-traveler-s-companion-florida.pdf
    • http://www.gorillawalker.com/traveling-at-the-speed-of-thought-einstein-and-the-quest.pdf
    • http://www.gorillawalker.com/scientific-examination-of-questioned-documents-second-edition-forensic-and-police.pdf
    • http://www.gorillawalker.com/nature-of-monotheism-in-koranic-thought-science-and-epistemology-in.pdf
    • http://www.gorillawalker.com/passport-to-world-band-radio-1998-serial.pdf
    • http://www.gorillawalker.com/que-monton-de-tamales-too-many-tamales-spanish-edition.pdf
    • http://www.gorillawalker.com/helping-people-live-with-chronic-illness.pdf
    • http://www.gorillawalker.com/integrated-chinese-level-2-part-2-textbook-the-integrated-chinese.pdf
    • http://www.gorillawalker.com/japanese-counterculture-the-antiestablishment-art-of-terayama-shuji.pdf
    • http://www.gorillawalker.com/the-great-comic-book-artists-volume-2.pdf
    • http://www.gorillawalker.com/rand-mcnally-streets-of-corpus-christi.pdf
    • http://www.gorillawalker.com/all-the-mighty-world-the-photographs-of-roger-fenton-1852.pdf
    • http://www.gorillawalker.com/the-who-guitar-tab-anthology-guitar-tab.pdf
    • http://www.gorillawalker.com/salads-the-good-cook-techniques-recipes-series.pdf
    • http://www.gorillawalker.com/how-to-be-great-at-doing-good-why-results-are.pdf
    • http://www.gorillawalker.com/blocked-by-caste-economic-discrimination-in-modern-india.pdf
    • http://www.gorillawalker.com/inquiry-logic-and-international-politics-studies-in-international-relations.pdf
    • http://www.gorillawalker.com/one-minute-pocket-bible-for-father-kindle-edition.pdf
    • http://www.gorillawalker.com/an-introduction-to-macroscopic-quantum-phenomena-and-quantum-dissipation.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.