Malicious PDF — malware analysis report

Static analysis result for SHA-256 7de1c16bc305d2bc…

MALICIOUS

PDF

43.7 KB Created: 2018-12-15 20:11:29 +03:00 Authoring application: Acrobat PDFMaker 9.1 для Word (via Adobe PDF Library 9.0)
MD5: aa4110e42ba2fda40c40da156d0614d9 SHA-1: b014157570e430da1a9e261ebedfc7cab1e7dffd SHA-256: 7de1c16bc305d2bcf6e82473cbae4bc2e7df2c8cc81f53f07f9fb02694dcc1b8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of external links, identified as a PDF SEO link farm. The document body, though heavily obfuscated, contains references to these external PDF URLs. This suggests the primary purpose is to redirect users to a large collection of external resources, potentially for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/managing-me-cfs-a-guide-for-young-people.pdf
    • http://www.gorillawalker.com/best-of-barbie-four-decades-of-america-s-favorite-doll.pdf
    • http://www.gorillawalker.com/mexico-city-travel-guide-sightseeing-hotel-restaurant-shopping-highlights.pdf
    • http://www.gorillawalker.com/all-new-letters-from-a-nut-includes-lunatic-email-exchanges.pdf
    • http://www.gorillawalker.com/the-tender-land-opera-in-three-acts-bh-stage-works.pdf
    • http://www.gorillawalker.com/strangeland-das-fremde-land-stimmen-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/valoraci-n-de-la-salud-en-enfermer-a-una-gu.pdf
    • http://www.gorillawalker.com/hot-in-the-saddle-the-men-of-the-circle-r.pdf
    • http://www.gorillawalker.com/iphone-tips-tricks-apps-hacks-vol-7.pdf
    • http://www.gorillawalker.com/the-last-honest-man-mordecai-richler-an-oral-biography.pdf
    • http://www.gorillawalker.com/practical-mental-toughness-training-for-boxing-using-visualization-to-control.pdf
    • http://www.gorillawalker.com/a-pastor-s-sketches-conversations-with-anxious-souls-concerning-the.pdf
    • http://www.gorillawalker.com/my-mother-is-a-tractor-a-life-in-rural-japan.pdf
    • http://www.gorillawalker.com/a-young-softball-player-s-guide-to-hitting-bunting-and.pdf
    • http://www.gorillawalker.com/the-revolutionary-guards-in-iranian-politics-elites-and-shifting-relations.pdf
    • http://www.gorillawalker.com/architecture-on-the-move-cities-and-mobilities.pdf
    • http://www.gorillawalker.com/the-essential-guide-to-federal-employment-law-2nd-second-edition.pdf
    • http://www.gorillawalker.com/lecture-notes-in-mathematical-biology.pdf
    • http://www.gorillawalker.com/old-mother-mexico.pdf
    • http://www.gorillawalker.com/defensive-wounds-theresa-maclean-novels.pdf
    • http://www.gorillawalker.com/brave-be-ready-and-victory-s-easy-a-story-about.pdf
    • http://www.gorillawalker.com/practical-antenna-handbook.pdf
    • http://www.gorillawalker.com/how-to-be-a-hotwife-cuckolding-erotica-the-hotwife-diaries.pdf
    • http://www.gorillawalker.com/sea-shell-the-story-of-shells-british-tanker-fleets-1892.pdf
    • http://www.gorillawalker.com/air-gear-22-air-gear-v22-paperback.pdf
    • http://www.gorillawalker.com/fashion-illustration-1920-1950-techniques-and-examples-dover-art-instruction.pdf
    • http://www.gorillawalker.com/bread-is-the-devil-win-the-weight-loss-battle-by.pdf
    • http://www.gorillawalker.com/the-sacred-santa-religious-dimensions-of-consumer-culture.pdf
    • http://www.gorillawalker.com/curiosity-house-the-shrunken-head-curiosity-house-series-book-1.pdf
    • http://www.gorillawalker.com/haunted-hijinks-an-agnes-barton-paranormal-mystery-volume-1.pdf
    • http://www.gorillawalker.com/basic-cruising-the-national-standard-for-quality-sailing-instruction-certification.pdf
    • http://www.gorillawalker.com/by-steven-n-meyers-flower-spirits-2013-wall-calendar-wal.pdf
    • http://www.gorillawalker.com/the-dying-sahara-us-imperialism-and-terror-in-africa.pdf
    • http://www.gorillawalker.com/barbara-bush-chelsea-house-library-of-biography.pdf
    • http://www.gorillawalker.com/texas-city-images-of-america.pdf
    • http://www.gorillawalker.com/tales-of-luna-c.pdf
    • http://www.gorillawalker.com/solidworks-2015-advanced-techniques.pdf
    • http://www.gorillawalker.com/flat-holm-bristol-channel-island.pdf
    • http://www.gorillawalker.com/versified-translation-of-the-songs-choruses-and-musical-dialogue-of.pdf
    • http://www.gorillawalker.com/nuclear-safeguards-security-and-nonproliferation-achieving-security-with-technology-and.pdf
    • http://www.gorillawalker.com/iphone-tips-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.