Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d7807bdd19cab9d…

MALICIOUS

PDF

45.7 KB Created: 2019-02-14 08:08:54 +03:00 Authoring application: dvipsk 5.58f Copyright 1986, 1994 Radical Eye Software (via Acrobat Distiller 3.0 f r Macintosh)
MD5: c770df44dd2cbc10b494adc0ec13587d SHA-1: 4113f76221dc345d94a441403de6bb0277d34b14 SHA-256: 7d7807bdd19cab9df8e219d318c1d1f0ad3f3cb58086d5631c278707043f919c
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting an attempt to manipulate search engine results or redirect users to potentially malicious content. The ML_NYX_PDF_MALICIOUS classifier also flagged the document as malicious. While no scripts were extracted, the sheer volume of links points towards a content-driven lure or a link farm designed to distribute further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/kids-stories-book-about-minecraft-a-collection-of-best-minecraft.pdf
    • http://www.gorillawalker.com/strong-minded-women-the-emergence-of-the-woman-suffrage-movement.pdf
    • http://www.gorillawalker.com/jolly-roger-chinese-characters.pdf
    • http://www.gorillawalker.com/the-rising-author-s-preferred-edition.pdf
    • http://www.gorillawalker.com/6-man-youth-flag-football-playbook.pdf
    • http://www.gorillawalker.com/quantum-statistics-of-linear-and-nonlinear-optical-phenomena.pdf
    • http://www.gorillawalker.com/injustice-on-trial-second-bull-run-the-court-martial-trial.pdf
    • http://www.gorillawalker.com/fighting-at-sea-in-the-eighteenth-century-the-art-of.pdf
    • http://www.gorillawalker.com/art-models-3-life-nude-photos-for-the-visual-arts.pdf
    • http://www.gorillawalker.com/it-s-not-the-size-of-the-data-it-s.pdf
    • http://www.gorillawalker.com/henry-the-helpful-elephant-squeaky-clean.pdf
    • http://www.gorillawalker.com/to-amend-title-xix-of-the-social-security-act-to.pdf
    • http://www.gorillawalker.com/pack-up-kids-let-s-go-encouragement-for-families-living.pdf
    • http://www.gorillawalker.com/enchanted-the-junior-novelization.pdf
    • http://www.gorillawalker.com/a-natural-history-of-sex-the-ecology-and-evolution-of.pdf
    • http://www.gorillawalker.com/who-is-the-beast.pdf
    • http://www.gorillawalker.com/olympia-bfi-film-classics.pdf
    • http://www.gorillawalker.com/a-theory-of-action-identification-basic-studies-in-human-behavior.pdf
    • http://www.gorillawalker.com/the-multiple-functions-of-sensory-motor-representations-a-special-issue.pdf
    • http://www.gorillawalker.com/diverse-communities-the-evolution-of-gay-and-lesbian-politics-in.pdf
    • http://www.gorillawalker.com/medical-surgical-nursing-patient-centered-collaborative-care-7th-edition-2.pdf
    • http://www.gorillawalker.com/dictador-del-futuro-el-spanish-edition.pdf
    • http://www.gorillawalker.com/sword-song-alfred-the-great-4-by-cornwell-bernard-reissue.pdf
    • http://www.gorillawalker.com/jewish-americans-one-nation.pdf
    • http://www.gorillawalker.com/discovering-england-from-one-inch-above-the-thames.pdf
    • http://www.gorillawalker.com/oxford-bach-books-for-organ-manuals-and-pedals-book-3.pdf
    • http://www.gorillawalker.com/unbridled-and-unforbidden-prequel-to-the-double-rider-men-s.pdf
    • http://www.gorillawalker.com/touch-for-health-a-practical-guide-to-natural-health-using.pdf
    • http://www.gorillawalker.com/little-league-to-the-major-leagues-a-complete-guide-to.pdf
    • http://www.gorillawalker.com/oracle-database-12c-pl-sql-programming.pdf
    • http://www.gorillawalker.com/the-blind-spy.pdf
    • http://www.gorillawalker.com/bioqu-mica-delos-microorganismos-spanish-edition.pdf
    • http://www.gorillawalker.com/silver-bullet-volume-4-montana-s-man-kevin-s-savior.pdf
    • http://www.gorillawalker.com/houghton-mifflin-spelling-and-vocabulary-student-edition-consumable-level-8.pdf
    • http://www.gorillawalker.com/look-up-pennsylvania-walking-tours-of-50-towns-in-the.pdf
    • http://www.gorillawalker.com/complete-guide-to-the-soviet-union.pdf
    • http://www.gorillawalker.com/the-activator-method-2e.pdf
    • http://www.gorillawalker.com/animerama-storia-del-cinema-d-animazione-biblioteca-italian-edition-kindle.pdf
    • http://www.gorillawalker.com/design-of-small-dams-water-resources-technical-publication-series.pdf
    • http://www.gorillawalker.com/the-other-side-of-the-river-book-14-marti-talbott.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.