Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d4a5777092a26e5…

MALICIOUS

PDF

42.9 KB Created: 2019-03-18 07:30:02 +03:00 Authoring application: TopLeaf 7.6.056 (via iText 2.1.7 by 1T3XT)
MD5: 8407ae40eb5692b2dc3147109569a22f SHA-1: 618e391cd659e9834c421f55b2a760dc40a85dae SHA-256: 6d4a5777092a26e58bfc6b7247b7fc41696be64004cbe482e4dfd9f7f82db3b0
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While no specific malicious script was extracted, the ML_NYX_PDF_MALICIOUS heuristic indicates a high probability of malicious intent. The embedded URLs are likely used to redirect users to malicious sites or to manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/dynamic-light-scattering-with-applications-to-chemistry-biology-and-physics.pdf
    • http://www.gorillawalker.com/official-book-club-selection-a-memoir-according-to-kathy-griffin.pdf
    • http://www.gorillawalker.com/celebrate-recovery-leader-s-guide.pdf
    • http://www.gorillawalker.com/werewolf-unleashed-werewolf-detectives-3-a-paranormal-mystery-romance-kindle.pdf
    • http://www.gorillawalker.com/the-emergence-of-social-cognition-in-three-young-chimpanzees.pdf
    • http://www.gorillawalker.com/why-are-all-the-black-kids-sitting-together-in-the.pdf
    • http://www.gorillawalker.com/managing-foreign-exchange-risk.pdf
    • http://www.gorillawalker.com/good-democratic-leadership-on-prudence-and-judgment-in-modern-democracies.pdf
    • http://www.gorillawalker.com/poker-at-the-millennium-hold-em-omaha.pdf
    • http://www.gorillawalker.com/the-aesthetics-of-excess-suny-series-in-aesthetics-and-the.pdf
    • http://www.gorillawalker.com/college-algebra-concepts-through-functions-a-la-carte-with-mml.pdf
    • http://www.gorillawalker.com/creating-effective-presentations-staff-development-with-impact.pdf
    • http://www.gorillawalker.com/zen-patterns-and-designs-coloring-for-artists.pdf
    • http://www.gorillawalker.com/raw-food-diet-for-beginners-the-all-natural-way-to.pdf
    • http://www.gorillawalker.com/teddy-bear-encyclopedia.pdf
    • http://www.gorillawalker.com/through-the-telescope-a-guide-for-the-amateur-astronomer-discovering.pdf
    • http://www.gorillawalker.com/strategic-management-quickstudy-business.pdf
    • http://www.gorillawalker.com/those-whom-the-gods-love.pdf
    • http://www.gorillawalker.com/early-instrumental-music-vol-4-english-music-from-middle-ages.pdf
    • http://www.gorillawalker.com/aimready.pdf
    • http://www.gorillawalker.com/pietre-dure-hardstone-in-furniture-and-decorations.pdf
    • http://www.gorillawalker.com/bundle-trigonometry-8th-enhanced-webassign-homework-with-ebook-access-card.pdf
    • http://www.gorillawalker.com/the-casualty.pdf
    • http://www.gorillawalker.com/welcome-speeches-for-special-days.pdf
    • http://www.gorillawalker.com/the-tattered-prayer-book-kindle-edition.pdf
    • http://www.gorillawalker.com/biomechanics-of-the-human-body-undergraduate-lecture-notes-in-physics.pdf
    • http://www.gorillawalker.com/cross-country-skiers-guide-to-connecticut.pdf
    • http://www.gorillawalker.com/madama-butterfly-vocal-score-g-schirmer-opera-score-editions.pdf
    • http://www.gorillawalker.com/traveller-20-referee-s-screen.pdf
    • http://www.gorillawalker.com/introduccion-a-la-quimica-terapeutica-introduction-to-chemical-treatment-spanish.pdf
    • http://www.gorillawalker.com/the-horse-and-its-relatives.pdf
    • http://www.gorillawalker.com/rocklands-beach-stories-kindle-edition.pdf
    • http://www.gorillawalker.com/handbook-of-chaos-control-foundations-and-applications.pdf
    • http://www.gorillawalker.com/lesbian-road-trip-taylor-kylie-s-wild-sexual-adventure.pdf
    • http://www.gorillawalker.com/bedford-guide-for-college-writers-9e-4-in-1-paper.pdf
    • http://www.gorillawalker.com/food-for-successful-kids-delicious-101-recipes-for-healthy-kids.pdf
    • http://www.gorillawalker.com/nevada-in-your-future-the-complete-relocation-guide-for-job.pdf
    • http://www.gorillawalker.com/fibroid-tumors-endometriosis-women-s-health.pdf
    • http://www.gorillawalker.com/handbook-of-materia-medica-homoeopathic-therapeutics.pdf
    • http://www.gorillawalker.com/the-english-language.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.