Malicious PDF — malware analysis report

Static analysis result for SHA-256 84d8eeeaa69ac0d1…

MALICIOUS

PDF

42.8 KB Created: 2018-12-03 17:53:02 +03:00 Authoring application: FrameMaker 7.2 (via Acrobat Distiller 7.0 (Windows))
MD5: a3c98d22590627542992d8a43e63acc2 SHA-1: 6a67cf9052d64db329e31dd01d1a668b49b019b0 SHA-256: 84d8eeeaa69ac0d19b7ce935d8ff587cb46ab69c82b694f48371f98e178c90ea
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this file as malicious. The primary attack pattern appears to be the distribution of a large number of links, potentially for SEO manipulation or to serve as a distribution point for other malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-quest-for-alien-planets-exploring-worlds-outside-the-solar.pdf
    • http://www.gorillawalker.com/a-cord-of-three-strands.pdf
    • http://www.gorillawalker.com/coleccion-de-causas-celebres-del-foro-peruano-y-extrangero-volumes.pdf
    • http://www.gorillawalker.com/the-last-single-girl-brew-ha-ha-1-volume-1.pdf
    • http://www.gorillawalker.com/anticorruption-in-transition-a-contribution-to-the-policy-debate.pdf
    • http://www.gorillawalker.com/voice-and-articulation.pdf
    • http://www.gorillawalker.com/heart-speaks-to-heart-the-story-of-blessed-john-henry.pdf
    • http://www.gorillawalker.com/cadillac-desert-by-marc-reisner-summary-analysis-the-american-west.pdf
    • http://www.gorillawalker.com/books-9787811305364-genuine-second-five-vocational-education-planning-materials-student.pdf
    • http://www.gorillawalker.com/hydraulic-servo-systems.pdf
    • http://www.gorillawalker.com/prostitutionspolitik-in-deutschland-entwicklung-im-kontext-europ-ischer-trends-essentials.pdf
    • http://www.gorillawalker.com/discus-throwing.pdf
    • http://www.gorillawalker.com/the-blackjack-hijack.pdf
    • http://www.gorillawalker.com/the-ultimate-soccer-encyclopedia.pdf
    • http://www.gorillawalker.com/myofascial-massage-lww-massage-therapy-bodywork-educational-series.pdf
    • http://www.gorillawalker.com/study-and-communication-skills-for-the-biosciences.pdf
    • http://www.gorillawalker.com/desperate-kindle-edition.pdf
    • http://www.gorillawalker.com/the-thin-book-of-soar-building-strengths-based-strategy.pdf
    • http://www.gorillawalker.com/capital-offenses-the-geography-of-class-and-crime-in-victorian.pdf
    • http://www.gorillawalker.com/edible-seattle-the-cookbook.pdf
    • http://www.gorillawalker.com/air-power-the-men-machines-and-ideas-that-revolutionized-war.pdf
    • http://www.gorillawalker.com/census-of-the-philippine-islands-taken-under-the-direction-of.pdf
    • http://www.gorillawalker.com/teaching-slides-for-respiratory-disease.pdf
    • http://www.gorillawalker.com/the-trashman-is-rich.pdf
    • http://www.gorillawalker.com/texas-farm-girl-reap-what-you-sow.pdf
    • http://www.gorillawalker.com/the-encyclopedia-of-butterflies.pdf
    • http://www.gorillawalker.com/the-humphreys-family-in-america-volume-2.pdf
    • http://www.gorillawalker.com/the-fundamentals-of-homotoxicology.pdf
    • http://www.gorillawalker.com/when-madness-comes-home-help-and-hope-for-families-of.pdf
    • http://www.gorillawalker.com/walks-around-chipping-campden-walkabout.pdf
    • http://www.gorillawalker.com/the-bipolar-disorder-survival-guide-second-edition-what-you-and.pdf
    • http://www.gorillawalker.com/the-twins-abroad-dorothy-whitehill-series-for-girls.pdf
    • http://www.gorillawalker.com/the-curious-writer-concise-edition-4th-edition.pdf
    • http://www.gorillawalker.com/global-shift-transforming-the-world-economy.pdf
    • http://www.gorillawalker.com/family-names-of-the-island-of-newfoundland.pdf
    • http://www.gorillawalker.com/nibbles-100-sweet-savoury-finger-foods.pdf
    • http://www.gorillawalker.com/collins-dictionary-thesaurus-of-the-english-language.pdf
    • http://www.gorillawalker.com/nonparametric-statistical-methods-for-complete-and-censored-data.pdf
    • http://www.gorillawalker.com/the-cell-companion-2016.pdf
    • http://www.gorillawalker.com/elephanta-the-cave-of-shiva.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.