Malicious PDF — malware analysis report

Static analysis result for SHA-256 704760951e3c7951…

MALICIOUS

PDF

44.7 KB Created: 2018-11-15 19:35:08 +03:00 Authoring application: Adobe InDesign CC 2017 (Windows) (via Adobe PDF Library 15.0)
MD5: 1e002cb980c1abb41b38dae513b9946a SHA-1: b2c0d5910df53858551c648ed8506c66349065a2 SHA-256: 704760951e3c79518a38efb27b50a4bc2ba3a950e9370d65e9acb70afac31e46
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and contains a large number of embedded links to external PDF files, indicating a link farm or content distribution tactic. The primary heuristic identified a mass external PDF link farm, suggesting the document's purpose is to redirect users to numerous other resources. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8173

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/el-ahorrador-inteligente-spanish-edition.pdf
    • http://www.gorillawalker.com/al-schneider-novel-magic.pdf
    • http://www.gorillawalker.com/big-trips-more-good-gay-travel-writing.pdf
    • http://www.gorillawalker.com/what-is-contemporary-art-a-guide-for-kids.pdf
    • http://www.gorillawalker.com/the-mother-within-a-guide-to-accepting-your-childless-journey.pdf
    • http://www.gorillawalker.com/beavers-my-first-animal-library.pdf
    • http://www.gorillawalker.com/solar-electricity-handbook-2010-edition-a-simple-practical-guide-to.pdf
    • http://www.gorillawalker.com/a-bravo-christmas-wedding-harlequin-special-edition-the-bravo-royales.pdf
    • http://www.gorillawalker.com/statistical-analysis-an-interdisciplinary-introduction-to-univariate-multivariate-methods.pdf
    • http://www.gorillawalker.com/in-sam-we-trust-the-untold-story-of-sam-walton.pdf
    • http://www.gorillawalker.com/the-doctrine-of-man-s-impotence.pdf
    • http://www.gorillawalker.com/america-s-first-families-an-inside-view-of-200-years.pdf
    • http://www.gorillawalker.com/metabolic-syndrome-dx-upheld-by-heart-groups-metabolic-disorders-an.pdf
    • http://www.gorillawalker.com/emilio-en-espana.pdf
    • http://www.gorillawalker.com/tools-working-wood-in-eighteenth-century-america-wallace-gallery-decorative.pdf
    • http://www.gorillawalker.com/blue-eyed-devil-a-novel.pdf
    • http://www.gorillawalker.com/ever-true-civil-war-letters-of-private-charles-mcdowell-new.pdf
    • http://www.gorillawalker.com/the-revival-of-banned-dances-a-worldwide-study.pdf
    • http://www.gorillawalker.com/acca-paper-11-tax-planning-lynchpins-this-title-has-been.pdf
    • http://www.gorillawalker.com/why-do-tigers-have-stripes-a-book-about-camouflage-why.pdf
    • http://www.gorillawalker.com/pascal-s-pens-es.pdf
    • http://www.gorillawalker.com/just-golden-puppies-2015-wall-calendar.pdf
    • http://www.gorillawalker.com/ser-tu-propio-entrenador-personal-la-anatom-a-de-entrenamiento.pdf
    • http://www.gorillawalker.com/sermons-from-a-forgotten-age.pdf
    • http://www.gorillawalker.com/global-wesleyan-dictionary-of-theology.pdf
    • http://www.gorillawalker.com/globalizing-capital-a-history-of-the-international-monetary-system-imf.pdf
    • http://www.gorillawalker.com/attention-difference-disorder-how-to-turn-your-adhd-child-or.pdf
    • http://www.gorillawalker.com/a-collection-of-my-favorite-health-recipes-kindle-edition.pdf
    • http://www.gorillawalker.com/how-por-qu-c-mo-hacemos-las-cosas-significa-tanto.pdf
    • http://www.gorillawalker.com/stay-safe-buddy-a-story-of-humor-and-horror-during.pdf
    • http://www.gorillawalker.com/top-50-most-delicious-quinoa-recipes-superfood-recipes-book-11.pdf
    • http://www.gorillawalker.com/reparaciones-y-proyectos-de-plomer-a.pdf
    • http://www.gorillawalker.com/israeli-and-palestinian-narratives-of-conflict-history-s-double-helix.pdf
    • http://www.gorillawalker.com/ebay-how-to-make-100-000-kindle-edition.pdf
    • http://www.gorillawalker.com/camino-footsteps-reflections-on-a-journey-to-santiago-de-compostela.pdf
    • http://www.gorillawalker.com/berlitz-language-german-for-your-trip-berlitz-for-your-trip.pdf
    • http://www.gorillawalker.com/orpheus-haunting-the-dead-anthology.pdf
    • http://www.gorillawalker.com/lonely-planet-make-my-day-tokyo-travel-guide.pdf
    • http://www.gorillawalker.com/pullman-wa-moscow-id-clarkston-wa-lewiston-id-street-map.pdf
    • http://www.gorillawalker.com/blundering-glory-napoleon-s-military-campaigns.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.