Malicious PDF — malware analysis report

Static analysis result for SHA-256 73abf23022cb06bf…

MALICIOUS

PDF

44.5 KB Created: 2019-04-03 18:29:48 +03:00 Authoring application: TeX (via pdfTeX-1.40.17)
MD5: 611ef59552ffd1cce4ed027dd6ee939c SHA-1: d24c3c15f69d3ad62d72dbeff8cd79171400abfd SHA-256: 73abf23022cb06bf07e6cfbda4d722145b071bd0660629cd05a672e3fc6b8435
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a pattern often associated with SEO manipulation or as a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with a high probability. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8224

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/oahu-revealed-the-ultimate-guide-to-honolulu-waikiki-beyond-oahu.pdf
    • http://www.gorillawalker.com/jazz-divas-original-keys-for-singers.pdf
    • http://www.gorillawalker.com/a-textbook-on-bridge-engineering-arithmetic-algebra-hydromechanics-pneumatics.pdf
    • http://www.gorillawalker.com/modern-steam-engines.pdf
    • http://www.gorillawalker.com/great-irish-poets-w-b-yeats-the-last-romantic.pdf
    • http://www.gorillawalker.com/cashing-up-kindle-edition.pdf
    • http://www.gorillawalker.com/dark-secrets-of-the-new-age-satan-s-plan-for.pdf
    • http://www.gorillawalker.com/fully-nonlinear-elliptic-equations-colloquium-publications-amer-mathematical-soc.pdf
    • http://www.gorillawalker.com/pocket-book-of-catholic-prayers-pocket-book-series.pdf
    • http://www.gorillawalker.com/aabo-universitets-l-rdomshistoria-matematikens-och-fysikens-studium-vid-bo.pdf
    • http://www.gorillawalker.com/comentario-exeg-tico-al-griego-del-nuevo-testamento-g-latas.pdf
    • http://www.gorillawalker.com/thunder-over-the-ochoco-volume-ii-distant-thunder.pdf
    • http://www.gorillawalker.com/anarchist-voices-an-oral-history-of-anarchism-in-america-abridged.pdf
    • http://www.gorillawalker.com/little-bunny-s-bible.pdf
    • http://www.gorillawalker.com/font-technology.pdf
    • http://www.gorillawalker.com/the-infant-survival-guide-protecting-your-baby-from-the-dangers.pdf
    • http://www.gorillawalker.com/schaum-s-outline-of-microbiology-second-edition-schaum-s-outline.pdf
    • http://www.gorillawalker.com/star-wars-omnibus-shadows-of-the-empire.pdf
    • http://www.gorillawalker.com/official-elvis-slim-calendar-2015.pdf
    • http://www.gorillawalker.com/sarah-campbell-tale-of-a-civil-war-orphan-civil-war.pdf
    • http://www.gorillawalker.com/the-golden.pdf
    • http://www.gorillawalker.com/cardiac-problems-in-pregnancy-diagnosis-and-management-of-maternal-and.pdf
    • http://www.gorillawalker.com/vasalisa-and-her-magic-doll.pdf
    • http://www.gorillawalker.com/mar-vol-12-v-12.pdf
    • http://www.gorillawalker.com/just-me-6-000-rats-a-tale-of-conjunctions-language.pdf
    • http://www.gorillawalker.com/schizophrenia-a-scientific-delusion-by-boyle-mary-routledge-2002-paperback.pdf
    • http://www.gorillawalker.com/statistical-and-computational-pharmacogenomics-chapman-hall-crc-interdisciplinary-statistics.pdf
    • http://www.gorillawalker.com/lene-berg.pdf
    • http://www.gorillawalker.com/sex-and-slavery-in-antebellum-new-orleans-real-lives-and.pdf
    • http://www.gorillawalker.com/believing-understanding-the-creed.pdf
    • http://www.gorillawalker.com/arabesque-harp-solo.pdf
    • http://www.gorillawalker.com/poetry-for-the-heart-of-love-and-life-kindle-edition.pdf
    • http://www.gorillawalker.com/in-a-dark-place-ed-lorraine-warren.pdf
    • http://www.gorillawalker.com/fortune-favors-the-bold-from-smartercomics.pdf
    • http://www.gorillawalker.com/roads-were-not-built-for-cars-how-cyclists-were-the.pdf
    • http://www.gorillawalker.com/revolting-youth-the-further-journals-of-nick-twisp.pdf
    • http://www.gorillawalker.com/red-dawn-darkly-erotic-fantasy.pdf
    • http://www.gorillawalker.com/masterpieces-of-glass-a-world-history-from-the-corning-museum.pdf
    • http://www.gorillawalker.com/the-camera-lucida-in-art-and-science.pdf
    • http://www.gorillawalker.com/the-book-in-society-an-introduction-to-print-culture.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.