Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c81b4e9bbeb9e15…

MALICIOUS

PDF

42.7 KB Created: 2018-11-15 18:32:05 +03:00 Authoring application: DocBook XSL Stylesheets with Apache FOP (via Apache FOP Version 2.1)
MD5: c344f4aeda1d99ddc45571c89f12b733 SHA-1: 07e85dfd344ab34bf6b7e06617f8af6cd1b9dc81 SHA-256: 7c81b4e9bbeb9e1524d4c9ff09272ea19643b65bfd7be56d9a9dcca179a30c5b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The embedded URLs point to a website that appears to host a collection of documents, suggesting a link farm or distribution point for potentially malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/veterinary-obstetrics-fourth-edition-chinese-edition.pdf
    • http://www.gorillawalker.com/learn-from-bobby-fischer-s-greatest-games.pdf
    • http://www.gorillawalker.com/paediatric-nephrology-oxford-specialist-handbooks-series-in-paediatrics.pdf
    • http://www.gorillawalker.com/anatomizing-the-gang-culture.pdf
    • http://www.gorillawalker.com/under-the-persimmon-tree.pdf
    • http://www.gorillawalker.com/clinical-electrocardiography-a-simplified-approach-8e.pdf
    • http://www.gorillawalker.com/the-new-american-grandparent-a-place-in-the-family-a.pdf
    • http://www.gorillawalker.com/farmers-of-forty-centuries-or-permanent-agriculture-in-china-korea.pdf
    • http://www.gorillawalker.com/psychic-crush-mind-control-erotica-psychic-domination-book-1.pdf
    • http://www.gorillawalker.com/school-refusal-behavior-in-youth-a-functional-approach-to-assessment.pdf
    • http://www.gorillawalker.com/catalogue-of-the-law-library-of-the-late-chancellor-sanford.pdf
    • http://www.gorillawalker.com/berlin-mitte-portr-t-eines-bezirks-stadtportr-ts-im-gmeiner.pdf
    • http://www.gorillawalker.com/the-first-days-of-school-how-to-be-an-effective.pdf
    • http://www.gorillawalker.com/transplantation-at-a-glance.pdf
    • http://www.gorillawalker.com/contemporary-japanese-politics-institutional-changes-and-power-shifts-contemporary-asia.pdf
    • http://www.gorillawalker.com/art-history-for-dummies.pdf
    • http://www.gorillawalker.com/modernism-modernist-design-1880-1940.pdf
    • http://www.gorillawalker.com/angina-pectoris-pipeline-review-q1-2011-download-pdf-digital.pdf
    • http://www.gorillawalker.com/a-zombie-ate-my-cupcake-25-deliciously-weird-cupcake-recipes.pdf
    • http://www.gorillawalker.com/79-park-avenue.pdf
    • http://www.gorillawalker.com/an-introduction-to-cystic-fibrosis-for-patients-and-families.pdf
    • http://www.gorillawalker.com/self-publishing-with-amazon-s-createspace-a-resource-guide-for.pdf
    • http://www.gorillawalker.com/the-anatomy-of-melancholy-hardcover.pdf
    • http://www.gorillawalker.com/tess-of-the-d-ubervilles-illustrated-kindle-edition.pdf
    • http://www.gorillawalker.com/national-audubon-society-field-guide-to-north-american-seashore-creatures.pdf
    • http://www.gorillawalker.com/medicines-ethics-and-practice-a-guide-for-pharmacists.pdf
    • http://www.gorillawalker.com/exploring-package-design-design-exploration-series.pdf
    • http://www.gorillawalker.com/123-jan-pienkowski-board-book-series.pdf
    • http://www.gorillawalker.com/fernando-castro-pacheco-color-e-imagen-de-yucatan-yucatan-raices.pdf
    • http://www.gorillawalker.com/jos-mourinho-special-leadership-special-leadership.pdf
    • http://www.gorillawalker.com/dry-brushing-a-guide-to-improving-your-skin-and-health.pdf
    • http://www.gorillawalker.com/law-of-public-communication-9th-edition-print-replica-kindle-edition.pdf
    • http://www.gorillawalker.com/heart-fire-celta.pdf
    • http://www.gorillawalker.com/songs-of-the-spirit-quaker-songs-hymnal-for-friends.pdf
    • http://www.gorillawalker.com/hunter-gatherer-specialised-subsistence-strategies-in-greece-during-the-upper.pdf
    • http://www.gorillawalker.com/alternative-urban-futures-planning-for-sustainable-development-in-cities-throughout.pdf
    • http://www.gorillawalker.com/the-san-francisco-earthquake-the-american-adventure-series-32.pdf
    • http://www.gorillawalker.com/pbx-systems-for-ip-telephony.pdf
    • http://www.gorillawalker.com/challenging-standards-navigating-conflict-and-building-capacity-in-the-era.pdf
    • http://www.gorillawalker.com/fda-approves-3-days-of-valacyclovir-for-genital-herpes-an.pdf
    • http://www.gorillawalker.com/clinical-e
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.