Malicious PDF — malware analysis report

Static analysis result for SHA-256 7baba7ebfd8baab4…

MALICIOUS

PDF

36.2 KB Created: 2019-10-29 07:28:36 +03:00 Authoring application: doPDF Ver 7.2 Build 376 (Windows XP Professional Edition (SP 3) - Version: 5.1.2600 (x86)) First seen: 2020-12-25
MD5: 8cbdd4b6843214186b03f49b8ddf79b1 SHA-1: f0a6bc381148e2220d50f20d9bbd07dc8a6d48fc SHA-256: 7baba7ebfd8baab451dafffc63c1c17a341c7ff52eb567155d79b062a1cb1191
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external websites, identified by the PDF_SEO_LINK_FARM heuristic. While no scripts were explicitly extracted, the presence of numerous links and a 'download button' lure suggests an attempt to direct users to potentially malicious content or for SEO manipulation. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7763

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/studyguide-for-applied-statistics-from-bivariate-through-multivariate-techniques-by.pdf In PDF document text
    • http://www.gorillawalker.com/the-end-of-business-as-usual-rewire-the-way-you.pdfIn PDF document text
    • http://www.gorillawalker.com/yeadon-s-register-of-lner-locomotives-gresley-8-coupled-engine.pdfIn PDF document text
    • http://www.gorillawalker.com/the-things-a-brother-knows.pdfIn PDF document text
    • http://www.gorillawalker.com/idea-to-invention-what-you-need-to-know-to-cash.pdfIn PDF document text
    • http://www.gorillawalker.com/designing-the-editorial-experience-a-primer-for-print-web-and.pdfIn PDF document text
    • http://www.gorillawalker.com/the-amazing-shoemaker-fairy-tales-and-legends-about-shoes-and.pdfIn PDF document text
    • http://www.gorillawalker.com/murder-on-the-links-hercule-poirot-mysteries.pdfIn PDF document text
    • http://www.gorillawalker.com/tax-amnesties-theory-trends-and-some-alternatives.pdfIn PDF document text
    • http://www.gorillawalker.com/aurora-composed-by-hans-zimmer-arr-gavin-greenaway-choral-octavo.pdfIn PDF document text
    • http://www.gorillawalker.com/love-s-masks-identity-intertextuality-and-meaning-in-the-old.pdfIn PDF document text
    • http://www.gorillawalker.com/punjab-province-map-scale-1-100-000-pakistan-1st-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/monsieur-ibrahim-and-the-flowers-modern-plays.pdfIn PDF document text
    • http://www.gorillawalker.com/roads-to-infinity-the-mathematics-of-truth-and-proof.pdfIn PDF document text
    • http://www.gorillawalker.com/he-s-just-no-good-for-you-a-guide-to.pdfIn PDF document text
    • http://www.gorillawalker.com/film-director-prep-encyclopedia-harass-resolved-chinese-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/binbir-gun-binbir-gece-osmanli-dan-gunumuze-istanbul-da-eglence.pdfIn PDF document text
    • http://www.gorillawalker.com/medical-transcription-guide-do-s-and-don-ts-2e.pdfIn PDF document text
    • http://www.gorillawalker.com/after-method-mess-in-social-science-research-international-library-of.pdfIn PDF document text
    • http://www.gorillawalker.com/esquema-ponzi-como-tirar-dinheiro-dos-incautos-portuguese-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/mathematical-modelling-of-transport-phenomena-processes.pdfIn PDF document text
    • http://www.gorillawalker.com/contracts-fourth-edition-textbook-treatise-series-hardcover.pdfIn PDF document text
    • http://www.gorillawalker.com/conflict-of-laws-2nd-suppt-to-11r-e.pdfIn PDF document text
    • http://www.gorillawalker.com/railway-traveller-s-handy-book.pdfIn PDF document text
    • http://www.gorillawalker.com/hugo-black-the-alabama-years.pdfIn PDF document text
    • http://www.gorillawalker.com/cal-96-amish-quilts.pdfIn PDF document text
    • http://www.gorillawalker.com/the-gulf-war-and-mental-health-a-comprehensive-guide.pdfIn PDF document text
    • http://www.gorillawalker.com/persecution-cd.pdfIn PDF document text
    • http://www.gorillawalker.com/priosadau-iddewig-pecyn-gwybodaeth-a-gweithgareddau-cyfres-gwyliau-iddewig-welsh.pdfIn PDF document text
    • http://www.gorillawalker.com/iec-60264-5-1-ed-1-0-b-1997-packaging.pdfIn PDF document text
    • http://www.gorillawalker.com/six-sigma-die-methode-die-qualitat-definiert-und-dadurch-messbar.pdfIn PDF document text
    • http://www.gorillawalker.com/cosplay-fever.pdfIn PDF document text
    • http://www.gorillawalker.com/nkjv-study-bible-for-kids-pink-teal-cover-the-premiere.pdfIn PDF document text
    • http://www.gorillawalker.com/becoming-influential-a-guide-for-nurses-1st-first-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/beyond-the-screen-emerging-cinema-and-engaging-audiences.pdfIn PDF document text
    • http://www.gorillawalker.com/bloomberg-by-bloomberg.pdfIn PDF document text
    • http://www.gorillawalker.com/manual-de-tuberia-comercial-pipe-trades-pocket-manual-spanish-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/group-psychotherapy-and-recovery-from-addiction-carrying-the-message.pdfIn PDF document text
    • http://www.gorillawalker.com/suzaku-2011-exploring-the-x-ray-universe-suzaku-and-beyond.pdfIn PDF document text
    • http://www.gorillawalker.com/batchawana-silly-stuff.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.