Malicious PDF — malware analysis report

Static analysis result for SHA-256 7311fb5b048adc44…

MALICIOUS

PDF

41.8 KB Created: 2018-12-02 10:56:20 +03:00 Authoring application: TeX (via MiKTeX pdfTeX-1.40.9) First seen: 2019-03-18
MD5: 9ba640b379c49c073007bb86459678a1 SHA-1: 683bce41aead2d432c01c3aa6b4876bc96cab1dd SHA-256: 7311fb5b048adc4412535a73000692dd0ee6afd66d63983f287927a476d21d6d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a heuristic firing for a large number of external links, all pointing to PDFs on the same domain. This suggests a link farm or SEO manipulation tactic. While no scripts were extracted, the sheer volume of outbound links indicates a malicious intent to direct users to potentially harmful content or to manipulate search engine rankings. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8219

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/paleo-cookbook-30-healthy-and-easy-paleo-diet-recipes-for.pdf In PDF document text
    • http://www.gorillawalker.com/kashmir-and-the-british-raj-1847-1947.pdfIn PDF document text
    • http://www.gorillawalker.com/meet-me-in-adelaide.pdfIn PDF document text
    • http://www.gorillawalker.com/practical-business-math-procedures-4th-fourth-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/the-blonde-brat-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/cthulhu-britannica-london-box-set.pdfIn PDF document text
    • http://www.gorillawalker.com/on-rough-seas.pdfIn PDF document text
    • http://www.gorillawalker.com/quick-reference-tables-for-business-math.pdfIn PDF document text
    • http://www.gorillawalker.com/monika-k.pdfIn PDF document text
    • http://www.gorillawalker.com/titanic-the-untold-tale-of-gay-passengers-and-crew.pdfIn PDF document text
    • http://www.gorillawalker.com/in-too-deep-the-39-clues-book-6.pdfIn PDF document text
    • http://www.gorillawalker.com/the-maximal-subgroups-of-the-low-dimensional-finite-classical-groups.pdfIn PDF document text
    • http://www.gorillawalker.com/drip-drop-genesis-6-8-noah-s-ark-hear-me.pdfIn PDF document text
    • http://www.gorillawalker.com/lawyering-skills-and-the-legal-process-law-in-context.pdfIn PDF document text
    • http://www.gorillawalker.com/roots-of-chinese-culture-and-medicine-academy-of-chinese-culture.pdfIn PDF document text
    • http://www.gorillawalker.com/the-logic-of-provability.pdfIn PDF document text
    • http://www.gorillawalker.com/elements-the-making-of-fine-monochrome-prints.pdfIn PDF document text
    • http://www.gorillawalker.com/wildlife-of-east-africa-princeton-pocket-guides.pdfIn PDF document text
    • http://www.gorillawalker.com/mortar-gunnery-fm-23-91-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/robert-ludlum-s-the-hades-factor.pdfIn PDF document text
    • http://www.gorillawalker.com/three-quests-in-philosophy-etienne-gilson-series.pdfIn PDF document text
    • http://www.gorillawalker.com/admit-to-mayhem-a-lillian-dove-mystery-series.pdfIn PDF document text
    • http://www.gorillawalker.com/uniforms-of-the-united-states-army-1774-1889-in-full.pdfIn PDF document text
    • http://www.gorillawalker.com/keeping-safe-as-a-new-graduate-borderline-personality-disorder-patient.pdfIn PDF document text
    • http://www.gorillawalker.com/jubilate-handbell-sheet-music-handbell-3-5-octaves-or-handchimes.pdfIn PDF document text
    • http://www.gorillawalker.com/political-philosophy-of-rousseau.pdfIn PDF document text
    • http://www.gorillawalker.com/wealth-prosperity-4-life-god-s-plan-for-you-to.pdfIn PDF document text
    • http://www.gorillawalker.com/trump-the-way-to-the-top-the-best-business-advice.pdfIn PDF document text
    • http://www.gorillawalker.com/get-tet-ein-inspector-vos-thriller-e-book-only-german.pdfIn PDF document text
    • http://www.gorillawalker.com/overview-of-the-bible-part-1.pdfIn PDF document text
    • http://www.gorillawalker.com/success-with-rhododendrons-and-azaleas.pdfIn PDF document text
    • http://www.gorillawalker.com/lucio-fontana.pdfIn PDF document text
    • http://www.gorillawalker.com/port-hope-simpson-off-the-beaten-path-vol-8-port.pdfIn PDF document text
    • http://www.gorillawalker.com/niche-strategies-for-downtown-revitalization-ichor-business-books.pdfIn PDF document text
    • http://www.gorillawalker.com/landmark-the-inside-story-of-america-s-new-health-care.pdfIn PDF document text
    • http://www.gorillawalker.com/information-technology-control-and-audit-second-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/environmental-monitoring-and-characterization.pdfIn PDF document text
    • http://www.gorillawalker.com/trauma-model-therapy-a-treatment-approach-for-trauma-dissociation-and.pdfIn PDF document text
    • http://www.gorillawalker.com/c-is-for-coeds-erotic-alphabet.pdfIn PDF document text
    • http://www.gorillawalker.com/conversations-with-jehovah-s-witnesses-kindle-edition.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000c62.bin
76116d8931f61403460fe14ae30e862a009e491f6d6dcce76ff3c0778fefc6ac		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC62 16170 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.