Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e30fab42999d853…

MALICIOUS

PDF

42.3 KB Created: 2019-03-17 02:30:22 +03:00 Authoring application: - (via iText 2.1.0 (by lowagie.com))
MD5: c9a7e943297d397d98dec3e767414ef4 SHA-1: 032d70b45798546a5e8a964ae1b393e79d530130 SHA-256: 7e30fab42999d85306d9c77036011b8454bc26fe74db31c82cae2311df1b3c5c
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The embedded URLs suggest an attempt to manipulate search engine results or distribute additional malicious content, rather than a direct user-facing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/heiress-to-the-throne-la-femme-fatale-publishing.pdf
    • http://www.gorillawalker.com/the-story-of-the-first-flute-based-on-an-ancient.pdf
    • http://www.gorillawalker.com/2010-yearbook-of-immigration-statistics.pdf
    • http://www.gorillawalker.com/kendo-world-7-1-kendo-world-magazine-volume-7-kindle.pdf
    • http://www.gorillawalker.com/the-secret-teachings.pdf
    • http://www.gorillawalker.com/introduction-to-chemical-physics-second-edition.pdf
    • http://www.gorillawalker.com/christian-ethics-at-the-boundary-feminism-and-theologies-at-public.pdf
    • http://www.gorillawalker.com/talk-less-say-more-three-habits-to-influence-others-and.pdf
    • http://www.gorillawalker.com/the-five-ancestors-book-2-monkey.pdf
    • http://www.gorillawalker.com/soil-enzymes.pdf
    • http://www.gorillawalker.com/pirates-vampire-witch-fantasy.pdf
    • http://www.gorillawalker.com/cash-tokens-transfers-a-history-of-urban-mass-transit-in.pdf
    • http://www.gorillawalker.com/user-education-for-online-systems-in-libraries.pdf
    • http://www.gorillawalker.com/michigan-panorama-books.pdf
    • http://www.gorillawalker.com/design-and-construction-practices-to-mitigate-cracking-special-publication-amer.pdf
    • http://www.gorillawalker.com/brightest-day-vol-1.pdf
    • http://www.gorillawalker.com/top-20-teachers-the-revolution-in-american-education.pdf
    • http://www.gorillawalker.com/tropical-agriculture-the-climate-soils-cultural-methods-crops.pdf
    • http://www.gorillawalker.com/el-espiritu-de-las-leyes.pdf
    • http://www.gorillawalker.com/flight-theory-for-pilots.pdf
    • http://www.gorillawalker.com/geheimnisse-der-pferde-german-edition.pdf
    • http://www.gorillawalker.com/russia-s-prestige-historical-architecture.pdf
    • http://www.gorillawalker.com/easy-diy-chicken-coop-plans-the-complete-guide-for-absolute.pdf
    • http://www.gorillawalker.com/let-s-study-1-corinthians-let-s-study-series-no.pdf
    • http://www.gorillawalker.com/pathfinder-player-companion-goblins-of-golarion.pdf
    • http://www.gorillawalker.com/creation-and-blessing-a-guide-to-the-study-and-exposition.pdf
    • http://www.gorillawalker.com/game-physics-morgan-kaufmann-series-in-interactive-3d-technology.pdf
    • http://www.gorillawalker.com/the-killing-uncommon-denominator.pdf
    • http://www.gorillawalker.com/numbering-in-american-sign-language.pdf
    • http://www.gorillawalker.com/college-algebra-5th-fifth-edition-bydugopolski.pdf
    • http://www.gorillawalker.com/wesleyan-university-off-the-record-college-prowler.pdf
    • http://www.gorillawalker.com/chemistry-concepts-and-problems-a-self-teaching-guide.pdf
    • http://www.gorillawalker.com/a-new-culture-of-learning-cultivating-the-imagination-for-a.pdf
    • http://www.gorillawalker.com/calvin-can-t-fly-the-story-of-a-bookworm-birdie.pdf
    • http://www.gorillawalker.com/learn-to-draw-pokemon-pencil-drawings-step-by-step-book.pdf
    • http://www.gorillawalker.com/shao-huaze-overseas-children-photography-set-hardcover-chinese-edition.pdf
    • http://www.gorillawalker.com/good-company-a-tramp-life.pdf
    • http://www.gorillawalker.com/ella-fitzgerald-black-americans-of-achievement.pdf
    • http://www.gorillawalker.com/strong-waters-a-simple-guide-to-making-beer-wine-cider.pdf
    • http://www.gorillawalker.com/la-energ-a-y-la-vida-bioenerg-tica-la-ciencia.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.