Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e764198b3666478…

MALICIOUS

PDF

35.1 KB Created: 2019-10-29 08:47:07 +03:00 Authoring application: - (via ProcessText Group)
MD5: b1e3b68ab56c8955469b515c563864d8 SHA-1: 6e2b42c61323e2be5f8cf6ccca8b25980e170b40 SHA-256: 6e764198b366647834aa4328806c52a37b3efe19e699b05109ec559322dbc9d5
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. While no scripts were explicitly extracted, the ML_NYX_PDF_MALICIOUS classifier suggests malicious intent. The embedded URLs likely serve to manipulate search engine rankings or redirect users to potentially malicious content, aligning with a spearphishing attachment tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8018

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/warriors-super-edition-firestar-s-quest.pdf
    • http://www.gorillawalker.com/trumpet-basics-a-method-for-individual-and-group-learning-teacher.pdf
    • http://www.gorillawalker.com/pornegrafik-pornographic.pdf
    • http://www.gorillawalker.com/the-rough-guide-to-buenos-aires-1-rough-guide-travel.pdf
    • http://www.gorillawalker.com/studio-television-production-and-directing-studio-television-production-and-directing.pdf
    • http://www.gorillawalker.com/rewriting-medieval-japanese-women-politics-personality-and-literary-production-in.pdf
    • http://www.gorillawalker.com/symphony-no2-op14-full-score-new-collected-works-volume-2.pdf
    • http://www.gorillawalker.com/the-gizmo-gizmo-books.pdf
    • http://www.gorillawalker.com/sissy-nation-how-america-became-a-culture-of-wimps-stoopits.pdf
    • http://www.gorillawalker.com/overview-of-alternative-dispute-resolution-adr-a-handbook-for-corps.pdf
    • http://www.gorillawalker.com/law-and-practice-for-architects-routledge-2005.pdf
    • http://www.gorillawalker.com/aviation-resource-management-proceedings-of-the-fourth-australian-aviation-psychology.pdf
    • http://www.gorillawalker.com/new-media-index-helps-assess-alcohol-risk-annual-meeting-of.pdf
    • http://www.gorillawalker.com/everything-you-need-to-know-about-the-dangers-of-sports.pdf
    • http://www.gorillawalker.com/the-dental-clinics-of-north-america-reconstructive-periodontics-volume-35.pdf
    • http://www.gorillawalker.com/10-000-bayt-min-al-shi-ar-al-arabi-volume.pdf
    • http://www.gorillawalker.com/the-return-of-the-rebel-angels-the-urantia-mysteries-and.pdf
    • http://www.gorillawalker.com/wild-animals-flip-flaps.pdf
    • http://www.gorillawalker.com/introduction-to-coastal-processes-and-geomorphology-1st-first-edition-by.pdf
    • http://www.gorillawalker.com/the-persian-presence-in-the-islamic-world-levi-della-vida.pdf
    • http://www.gorillawalker.com/snmp-a-guide-to-network-management.pdf
    • http://www.gorillawalker.com/prolegomena-to-the-metaphysics-of-islam-an-exposition-of-the.pdf
    • http://www.gorillawalker.com/victorian-poetry-in-context-texts-and-contexts-kindle-edition.pdf
    • http://www.gorillawalker.com/the-tao-of-nutrition-new-and-expanded-edition.pdf
    • http://www.gorillawalker.com/curating-research-occasional-table.pdf
    • http://www.gorillawalker.com/sexplosions-power-surge-book-one-superhero-erotic-romance.pdf
    • http://www.gorillawalker.com/the-illuminated-rumi-2011-wall-calendar.pdf
    • http://www.gorillawalker.com/gre-vocabulary-flashcards-3-0-3859-gre-words-with-audio.pdf
    • http://www.gorillawalker.com/collected-essays-journalism-and-letters-in-front-of-your-nose.pdf
    • http://www.gorillawalker.com/greening-the-built-environment.pdf
    • http://www.gorillawalker.com/adriana-lecouvreur-act-ii-aria-l-anima-ho-stanca-viola.pdf
    • http://www.gorillawalker.com/a-pocket-history-of-the-civil-war-citizen-soldiers-bloody.pdf
    • http://www.gorillawalker.com/mine-plant-design.pdf
    • http://www.gorillawalker.com/textbook-of-bunion-surgery.pdf
    • http://www.gorillawalker.com/how-to-think-critically-a-concise-guide.pdf
    • http://www.gorillawalker.com/the-owl-and-the-nightingale-musical-life-and-ideas-in.pdf
    • http://www.gorillawalker.com/national-geographic-little-kids-look-and-learn-people-look-learn.pdf
    • http://www.gorillawalker.com/the-salicylate-handbook-your-guide-to-understanding-salicylate-sensitivity.pdf
    • http://www.gorillawalker.com/russian-english-and-english-russian-dictionary-of-radar-and-electronics.pdf
    • http://www.gorillawalker.com/ciclidos-sudamericanos-south-american-cichlids-manuales-del-acuario-aquariam-manuals.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.