Malicious PDF — malware analysis report

Static analysis result for SHA-256 760730c1f4febff8…

MALICIOUS

PDF

43.8 KB Created: 2018-11-26 08:22:25 +03:00 Authoring application: Writer (via OpenOffice.org 2.4)
MD5: e8dc7b751e75684ab0a2b6a1cca46405 SHA-1: 5208aab56d4fdd0fc905dcb540552a934b4dc6b9 SHA-256: 760730c1f4febff88f0b5c2c853d48f4c1f7a5f500d1f96618788636d5b1fbc8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, all hosted on the same domain. This behavior is indicative of a link farm, likely intended for SEO manipulation or to serve as a distribution point for further malicious content. The ML classifier also flagged this PDF as malicious, supporting this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9016

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/cedar-rapids-diy-city-guide-and-travel-journal-city-notebook.pdf
    • http://www.gorillawalker.com/franz-liszt-gde-to-rsh-composer-resource-manuals.pdf
    • http://www.gorillawalker.com/bungalows-design-ideas-for-renovating-remodeling-and-build-updating-classic.pdf
    • http://www.gorillawalker.com/bugs-collins-big-cat.pdf
    • http://www.gorillawalker.com/colorado-2015-scenic-wall-calendar.pdf
    • http://www.gorillawalker.com/for-the-love-of-god-volume-2-a-daily-companion.pdf
    • http://www.gorillawalker.com/sammy-s-tree-mendous-christmas-adventure-finding-the-true-meaning.pdf
    • http://www.gorillawalker.com/the-agricola-and-germania.pdf
    • http://www.gorillawalker.com/hand-bone-age-a-digital-atlas-of-skeletal-maturity.pdf
    • http://www.gorillawalker.com/american-horticultural-society-gardening-manual-american-horticultural-society-practical-guides.pdf
    • http://www.gorillawalker.com/german-shorthaired-pointers-multilingual-edition.pdf
    • http://www.gorillawalker.com/metaphysics-of-war.pdf
    • http://www.gorillawalker.com/wind-energy-utilization-a-bibliography-with-abstracts-cumulative-volume-1.pdf
    • http://www.gorillawalker.com/bible-cover-genuine-leather-large-brown-classic-quality.pdf
    • http://www.gorillawalker.com/qualitative-research-methodologies-for-occupational-science-and-therapy.pdf
    • http://www.gorillawalker.com/nuclear-medicine-case-review-series-2e-2nd-second-edition-by.pdf
    • http://www.gorillawalker.com/around-the-world-art-activities-visiting-the-7-continents-through.pdf
    • http://www.gorillawalker.com/predation-on-birds-caught-in-mist-nets-in-upland-kenyan.pdf
    • http://www.gorillawalker.com/football-in-sun-and-shadow.pdf
    • http://www.gorillawalker.com/no-ordinary-women-irish-female-activists-in-the-revolutionary-years.pdf
    • http://www.gorillawalker.com/un-mundo-nuevo-spanish-edition.pdf
    • http://www.gorillawalker.com/coupled-systems-theory-models-and-applications-in-engineering-chapman-hall.pdf
    • http://www.gorillawalker.com/las-suegras-perjudican-seriamente-la-salud-mothers-in-law-damage.pdf
    • http://www.gorillawalker.com/fighting-temptation-faith-4-life-junior-high-bible-study.pdf
    • http://www.gorillawalker.com/teaching-nursing.pdf
    • http://www.gorillawalker.com/the-new-b-b-c-book-of-bowls.pdf
    • http://www.gorillawalker.com/who-was-abraham-lincoln.pdf
    • http://www.gorillawalker.com/historical-account-of-the-most-celebrated-voyages-travels-and-discoveries.pdf
    • http://www.gorillawalker.com/florencia-e-mallon-courage-tastes-of-blood-the-mapuche-community.pdf
    • http://www.gorillawalker.com/give-em-pumpkin-to-talk-about-pumpkin-patch-mysteries-book.pdf
    • http://www.gorillawalker.com/sounding-of-the-pun-the-official-spoonerism-game-an-article.pdf
    • http://www.gorillawalker.com/only-in-spain-a-foot-stomping-firecracker-of-a-memoir.pdf
    • http://www.gorillawalker.com/nacktgebiete-das-verlorene-paradies-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/providing-food-security-for-all-ifad-studies-in-rural-poverty.pdf
    • http://www.gorillawalker.com/by-richard-j-ablin-the-great-prostate-hoax-how-big.pdf
    • http://www.gorillawalker.com/power-from-on-high-what-it-is-and-how-to.pdf
    • http://www.gorillawalker.com/st-seraphim-of-sarov.pdf
    • http://www.gorillawalker.com/17-day-diet-record-your-weight-loss-progress-with-calorie.pdf
    • http://www.gorillawalker.com/mel-bay-the-joy-of-flute-and-guitar.pdf
    • http://www.gorillawalker.com/persuasion-heirs-of-watson-island-book-2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.