Malicious PDF — malware analysis report

Static analysis result for SHA-256 7103cae2dcbbe496…

MALICIOUS

PDF

38.9 KB Created: 2018-11-26 08:23:10 +03:00 Authoring application: Adobe Acrobat 7.05 (via Adobe Acrobat 7.05 Paper Capture Plug-in)
MD5: c57fee40145031dbd0465b159e798739 SHA-1: c6b9fb70f79bccb84317b25609cc710e3bd8907c SHA-256: 7103cae2dcbbe4960ae10e7ea91c83ed827036339c1c85b9b551de11f3c7beba
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The primary purpose appears to be to direct users to a website hosting numerous documents, potentially for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8379

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/facilities-management-towards-best-practice.pdf
    • http://www.gorillawalker.com/the-clyde-puffer.pdf
    • http://www.gorillawalker.com/the-sandman-companion.pdf
    • http://www.gorillawalker.com/spelling-pupil-book-1-collins-primary-focus.pdf
    • http://www.gorillawalker.com/claiming-carlos-contemporary-romance-sanchez-sisters-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/merleau-ponty-existentialist-of-the-social-world.pdf
    • http://www.gorillawalker.com/nitric-oxide-in-the-nervous-system-neuroscience-perspectives.pdf
    • http://www.gorillawalker.com/the-tattoo-history-source-book-by-steve-gilbert-paperback.pdf
    • http://www.gorillawalker.com/treatment-of-pressure-ulcers-guideline-technical-report.pdf
    • http://www.gorillawalker.com/antidepressants-and-their-side-effects-managing-the-risks.pdf
    • http://www.gorillawalker.com/uncle-scrooge-386.pdf
    • http://www.gorillawalker.com/new-labour-s-pasts-the-labour-party-and-its-discontents.pdf
    • http://www.gorillawalker.com/how-to-do-things-with-logic.pdf
    • http://www.gorillawalker.com/the-communicative-value-of-intonation-in-english-book-applied-linguistics.pdf
    • http://www.gorillawalker.com/psoriasis-money-eat-to-defeat-magic-potions-and-cures-eat.pdf
    • http://www.gorillawalker.com/primatologia-iii-2.pdf
    • http://www.gorillawalker.com/promises-for-you-from-the-new-international-version.pdf
    • http://www.gorillawalker.com/cats-2015-weekly-planner-by-ziga-media-llc.pdf
    • http://www.gorillawalker.com/spotlight-on-special-educational-needs-visual-impairment-david-fulton-nasen.pdf
    • http://www.gorillawalker.com/governing-high-seas-fisheries-the-interplay-of-global-and-regional.pdf
    • http://www.gorillawalker.com/rough-guide-directions-bruges-ghent.pdf
    • http://www.gorillawalker.com/spring-snow-the-sea-of-fertility-1-vintage-international-kindle.pdf
    • http://www.gorillawalker.com/god-s-priorities-for-your-life-for-teens.pdf
    • http://www.gorillawalker.com/bipolar-disorder-for-dummies-3rd-edition.pdf
    • http://www.gorillawalker.com/romeo-and-juliet-a-unit-plan-litplans-on-cd.pdf
    • http://www.gorillawalker.com/le-basi-della-fotografia-notturna-in-digitale-italian-edition-kindle.pdf
    • http://www.gorillawalker.com/popular-piano-solos-grade-5-pop-hits-broadway-movies-and.pdf
    • http://www.gorillawalker.com/variations-on-an-apple-a-tor-com-original.pdf
    • http://www.gorillawalker.com/biographic-dictionary-of-espionage.pdf
    • http://www.gorillawalker.com/your-cat-s-first-year.pdf
    • http://www.gorillawalker.com/yu-gi-oh-23.pdf
    • http://www.gorillawalker.com/strange-encounters-adventures-of-a-renegade-naturalist.pdf
    • http://www.gorillawalker.com/seducing-the-widow-m-f-regency-erotica.pdf
    • http://www.gorillawalker.com/psycho-cybernetics-how-to-use-the-power-of-self-image.pdf
    • http://www.gorillawalker.com/nelson-phonics-spelling-and-handwriting-cd-rom.pdf
    • http://www.gorillawalker.com/corsica-north.pdf
    • http://www.gorillawalker.com/la-nochebuena.pdf
    • http://www.gorillawalker.com/fragging-why-u-s-soldiers-assaulted-their-officers-in-vietnam.pdf
    • http://www.gorillawalker.com/toni-morrison-a-biography-of-a-nobel-prize-winning-writer.pdf
    • http://www.gorillawalker.com/championship-omaha.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.