Malicious PDF — malware analysis report

Static analysis result for SHA-256 82b3021959128ba2…

MALICIOUS

PDF

42.3 KB Created: 2019-01-06 08:29:54 +03:00 Authoring application: AH XSL Formatter V6.2 MR5 for Windows (x64) : 6.2.7.18952 (via Antenna House PDF Output Library 6.2.625 (Windows (x64)))
MD5: 53a67148656ada794800c6c97924edd8 SHA-1: 8523174cdf4173c75eab8bfe382d81331c67ec3f SHA-256: 82b3021959128ba275299394390edc042da0f5c1f68c680472bd3c0e9a9a7c2c
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. While no scripts were explicitly extracted, the presence of embedded URLs within the document body suggests an attempt to direct users to a website. This behavior is consistent with SEO manipulation or potentially distributing further malicious content, and the ML classifier also flagged it as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/theory-of-heavy-ion-collision-physics-in-hadron-therapy-volume.pdf
    • http://www.gorillawalker.com/knowledge-and-liberation-tibetan-buddhist-epistemology-in-support-of-transformative.pdf
    • http://www.gorillawalker.com/priority-setting-processes-for-healthcare-in-oregon-usa-new-zealand.pdf
    • http://www.gorillawalker.com/irrigation-water-management-principles-and-practice-kindle-edition.pdf
    • http://www.gorillawalker.com/wired-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/a-devil-and-her-love-song-vol-4.pdf
    • http://www.gorillawalker.com/egmont-the-story-of-a-mountain.pdf
    • http://www.gorillawalker.com/hole-look-through-this.pdf
    • http://www.gorillawalker.com/love-at-last-series-box-set.pdf
    • http://www.gorillawalker.com/the-dreaming-void-void-trilogy-book-1-unabridged-audible-audio.pdf
    • http://www.gorillawalker.com/gem-cutting-is-easy.pdf
    • http://www.gorillawalker.com/a-dialogue-kindle-edition.pdf
    • http://www.gorillawalker.com/human-melanoma-from-basic-research-to-clinical-application.pdf
    • http://www.gorillawalker.com/bloodman.pdf
    • http://www.gorillawalker.com/aprender-italiano-textos-paralelos-historias-sencillas-espa.pdf
    • http://www.gorillawalker.com/this-road-tonight-a-new-pilgrim-s-progress.pdf
    • http://www.gorillawalker.com/stability-theory-of-elastic-rods-series-on-stability-vibration-and.pdf
    • http://www.gorillawalker.com/we-can-t-teach-what-we-don-t-know-white.pdf
    • http://www.gorillawalker.com/colourful-food-chinese-readers-series-d-level-1-orange-chinese.pdf
    • http://www.gorillawalker.com/confronting-poverty-weak-states-and-u-s-national-security.pdf
    • http://www.gorillawalker.com/mexican-americans-successful-americans.pdf
    • http://www.gorillawalker.com/the-hendricks-haiku-project-ii-collected-poems-from-hendricks-avenue.pdf
    • http://www.gorillawalker.com/advocacy-and-opposition-an-introduction-to-argumentation-4th-edition.pdf
    • http://www.gorillawalker.com/closing-my-legs-kindle-edition.pdf
    • http://www.gorillawalker.com/dynamics-of-marine-structures-methods-of-calculating-the-dynamic-response.pdf
    • http://www.gorillawalker.com/aviation-mechanic-handbook-the-aviation-standard.pdf
    • http://www.gorillawalker.com/how-to-keep-erect-naturally.pdf
    • http://www.gorillawalker.com/alzheimer-s-science-and-god.pdf
    • http://www.gorillawalker.com/time-varying-image-processing-and-moving-object-recognition-proceedings-of.pdf
    • http://www.gorillawalker.com/creating-lightweight-components-with-atl.pdf
    • http://www.gorillawalker.com/quick-n-cheap-recipes-for-a-flat-belly-and-raw.pdf
    • http://www.gorillawalker.com/the-coffin-quilt-the-feud-between-the-hatfields-and-the.pdf
    • http://www.gorillawalker.com/on-the-trail-of-the-d-c-sniper-fear-and.pdf
    • http://www.gorillawalker.com/the-bobbsey-twins-at-the-county-fair-paperback.pdf
    • http://www.gorillawalker.com/physics-for-flash-games-animation-and-simulations.pdf
    • http://www.gorillawalker.com/gorillas-rain-forest-animals.pdf
    • http://www.gorillawalker.com/confessions-of-a-therapist.pdf
    • http://www.gorillawalker.com/looking-for-a-rain-god-and-other-short-stories-from.pdf
    • http://www.gorillawalker.com/zagatsurvey-2004-downtown-new-york-city-below-houston-street-zagatsurvey.pdf
    • http://www.gorillawalker.com/auschwitz-the-story-of-a-nazi-death-camp-watts-nonfiction.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.