Malicious PDF — malware analysis report

Static analysis result for SHA-256 72117bc32c742e78…

MALICIOUS

PDF

41.6 KB Created: 2018-11-23 21:05:28 +03:00 Authoring application: Arbortext 5.4 (via PDFlib+PDI 7.0.4 (Win32))
MD5: 5be82a04ec0bf5eef276a3cc200b7245 SHA-1: a7705c7651841b7081fbbe8757e6b069da59fa03 SHA-256: 72117bc32c742e78a5034c79f272d54408d8be11fe4f97d38e95a8a5052a5db9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files on the same domain, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. This suggests a tactic to manipulate search engine results or to act as a distribution point for further malicious documents. No scripts were extracted, and the document body was unreadable, limiting the analysis to the URL structure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/careercode-career-changer-workbook.pdf
    • http://www.gorillawalker.com/to-live-with-christ-devotions-by-bo-giertz.pdf
    • http://www.gorillawalker.com/human-resources-annual-editions-human-resources.pdf
    • http://www.gorillawalker.com/charles-the-untold-story.pdf
    • http://www.gorillawalker.com/final-strike-executioner-285.pdf
    • http://www.gorillawalker.com/vi-hotine-marussi-symposium-on-theoretical-and-computational-geodesy-iag.pdf
    • http://www.gorillawalker.com/star-of-the-morning-the-nine-kingdoms-book-1.pdf
    • http://www.gorillawalker.com/internal-combustion-engines-their-theory-construction-and-operation-kindle-edition.pdf
    • http://www.gorillawalker.com/paleo-box-set-4-in-1-the-complete-extensive-guide.pdf
    • http://www.gorillawalker.com/western-justice-trilogy.pdf
    • http://www.gorillawalker.com/operations-strategy-and-technology-pursuing-the-competitive-edge.pdf
    • http://www.gorillawalker.com/mental-health-dimensions-of-self-esteem-and-emotional-well-being.pdf
    • http://www.gorillawalker.com/gods-at-war-combat-journal.pdf
    • http://www.gorillawalker.com/health-care-teamwork-interdisciplinary-practice-and-teaching.pdf
    • http://www.gorillawalker.com/how-to-speak-pirate-a-treasure-chest-of-seafaring-slang.pdf
    • http://www.gorillawalker.com/essentials-of-accounting.pdf
    • http://www.gorillawalker.com/welding-handbook-applications-of-welding-section-five.pdf
    • http://www.gorillawalker.com/la-problematica-de-la-etica-en-los-negocios-spanish-edition.pdf
    • http://www.gorillawalker.com/making-your-children-s-ministry-the-best-hour-of-every.pdf
    • http://www.gorillawalker.com/fausto-falo-y-mefist-feles-serpiente-spanish-edition.pdf
    • http://www.gorillawalker.com/no-pasar-n-art-literature-and-the-civil-war-monograf.pdf
    • http://www.gorillawalker.com/supplement-to-the-bibliography-of-north-american-invertebrate-paleontology.pdf
    • http://www.gorillawalker.com/the-cornish-riviera-beautiful-england.pdf
    • http://www.gorillawalker.com/the-cartoonist-workbook.pdf
    • http://www.gorillawalker.com/ancestral-maya-economies-in-archaeological-perspective.pdf
    • http://www.gorillawalker.com/the-adventures-of-the-three-little-clouds.pdf
    • http://www.gorillawalker.com/choosing-names-man-kzin-wars-viii.pdf
    • http://www.gorillawalker.com/point-of-infliction.pdf
    • http://www.gorillawalker.com/lonely-planet-nova-scotia-new-brunswick-prince-edward-island-travel.pdf
    • http://www.gorillawalker.com/eighth-grade-is-making-me-sick-ginny-davis-s-year.pdf
    • http://www.gorillawalker.com/mountain-and-the-chef.pdf
    • http://www.gorillawalker.com/a-call-to-russia-glimpses-of-missionary-life-from-the.pdf
    • http://www.gorillawalker.com/mostly-harmless-econometrics-an-empiricist-s-companion-kindle-edition.pdf
    • http://www.gorillawalker.com/command-bonds-book-3-kindle-edition.pdf
    • http://www.gorillawalker.com/beginner-s-raised-bed-gardening-five-steps-to-building-your.pdf
    • http://www.gorillawalker.com/the-little-book-of-common-sense-investing-the-only-way.pdf
    • http://www.gorillawalker.com/the-flow-of-consciousness-maharishi-mahesh-yogi-on-literature-and.pdf
    • http://www.gorillawalker.com/the-asian-currency-crisis-paperback.pdf
    • http://www.gorillawalker.com/novena-to-the-blessed-virgin-mary.pdf
    • http://www.gorillawalker.com/bike-battles-a-history-of-sharing-the-american-road.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.