Malicious PDF — malware analysis report

Static analysis result for SHA-256 728deb70a8e138c3…

MALICIOUS

PDF

45.2 KB Created: 2019-02-15 20:04:52 +03:00 Authoring application: QuarkXPress(R) 8.0 First seen: 2019-02-26
MD5: b971ca989c7c4a1d096dfeb97c52f704 SHA-1: 03e95fd2371d8f92daa9aa4b00f3f884a3cb6631 SHA-256: 728deb70a8e138c3e986020cf5610ce700738eedcc0b74a25b7a6b0f31e76678
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document. The embedded URLs suggest an attempt to manipulate search engine results or distribute potentially malicious content disguised as legitimate documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/lifepac-spanish-i-teachers-guide-alpha-omega.pdf In PDF document text
    • http://www.gorillawalker.com/cascade-alpine-guide-stevens-pass-to-rainy-pass.pdfIn PDF document text
    • http://www.gorillawalker.com/the-tourist-in-portugal-illustrated-from-paintings-by-james-holland.pdfIn PDF document text
    • http://www.gorillawalker.com/american-cinema-american-culture-4th-edition-print-replica-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/eva-s-sweet-revenge-happy-valentine-s-day.pdfIn PDF document text
    • http://www.gorillawalker.com/cultural-memory-and-biodiversity-paperback.pdfIn PDF document text
    • http://www.gorillawalker.com/sylvia-plath-a-biography.pdfIn PDF document text
    • http://www.gorillawalker.com/rainbow-zoo-neighborhood-readers.pdfIn PDF document text
    • http://www.gorillawalker.com/the-iscariot-agenda-vatican-knights-book-3-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/orthopedic-taping-wrapping-bracing-and-padding-second-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/getting-digital-marketing-right-a-simplified-process-for-business-growth.pdfIn PDF document text
    • http://www.gorillawalker.com/next-generation-sequencing-in-cancer-research-volume-2-from-basepairs.pdfIn PDF document text
    • http://www.gorillawalker.com/the-week-that-changed-the-world.pdfIn PDF document text
    • http://www.gorillawalker.com/public-administration-an-action-orientation-6th-sixth-edition-by-denhardt.pdfIn PDF document text
    • http://www.gorillawalker.com/holt-literature-language-arts-first-course-language-sentence-skills-practice.pdfIn PDF document text
    • http://www.gorillawalker.com/in-continents.pdfIn PDF document text
    • http://www.gorillawalker.com/metaheuristic-search-concepts-a-tutorial-with-applications-to-production-and.pdfIn PDF document text
    • http://www.gorillawalker.com/hospitalist-recruitment-and-retention-building-a-hospital-medicine-program.pdfIn PDF document text
    • http://www.gorillawalker.com/a-practical-guide-to-road-traffic-accident-claims-practitioner-series.pdfIn PDF document text
    • http://www.gorillawalker.com/lonely-planet-great-lakes.pdfIn PDF document text
    • http://www.gorillawalker.com/the-stage-manager-s-toolkit-templates-and-communication-techniques-to.pdfIn PDF document text
    • http://www.gorillawalker.com/harrison-s-law-and-economics-in-a-nutshell-5th.pdfIn PDF document text
    • http://www.gorillawalker.com/beyond-the-basics-advanced-kitchen-design.pdfIn PDF document text
    • http://www.gorillawalker.com/fluid-and-electrolytes-in-pediatrics-a-comprehensive-handbook-nutrition-and.pdfIn PDF document text
    • http://www.gorillawalker.com/the-little-girl-who-loved-sweets-a-book-for-children.pdfIn PDF document text
    • http://www.gorillawalker.com/the-handbook-of-country-risk.pdfIn PDF document text
    • http://www.gorillawalker.com/the-microtremor-survey-method-geophysical-monograph-series-no-12.pdfIn PDF document text
    • http://www.gorillawalker.com/bookbinding-and-the-care-of-books.pdfIn PDF document text
    • http://www.gorillawalker.com/stranger-in-the-forest-on-foot-across-borneo-methuen-non.pdfIn PDF document text
    • http://www.gorillawalker.com/quicken-2009-the-missing-manual.pdfIn PDF document text
    • http://www.gorillawalker.com/mounted-by-a-monster-sacrifice-for-the-dragon.pdfIn PDF document text
    • http://www.gorillawalker.com/el-teniente-gustl-lieutenant-gustl-cuadernos-del-acantilado-cliff-notebooks.pdfIn PDF document text
    • http://www.gorillawalker.com/air-disaster-3-terror-in-the-sky.pdfIn PDF document text
    • http://www.gorillawalker.com/silver-hawk-a-warrior-s-heart-juanita-s-journal-volume.pdfIn PDF document text
    • http://www.gorillawalker.com/building-law-reports-v-38.pdfIn PDF document text
    • http://www.gorillawalker.com/biophysics-of-human-hair-structural-nanomechanical-and-nanotribological-studies-biological.pdfIn PDF document text
    • http://www.gorillawalker.com/arctic-explorations-and-discoveries-during-the-nineteenth-century-being-detailed.pdfIn PDF document text
    • http://www.gorillawalker.com/murder-at-cape-three-points-a-darko-dawson-mystery.pdfIn PDF document text
    • http://www.gorillawalker.com/contemporary-chinese-exercise-book-1-chinese-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/wingnut-s-complete-surfing.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.