Malicious PDF — malware analysis report

Static analysis result for SHA-256 8635086c4b7efdb4…

MALICIOUS

PDF

48.1 KB Created: 2019-03-18 06:17:46 +03:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0)
MD5: 1d54b9b0f3ead6301157332ae6a9d009 SHA-1: 1ac409160788769e155a70dbee4ba54adc8d609f SHA-256: 8635086c4b7efdb46dec6a72a61b8ec5f4e58cdf1631d1b4a57e43a9824c77a6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or distribution mechanism. The ML classifier also indicated a high probability of maliciousness. No scripts were extracted, and the document body was unreadable, but the sheer volume of linked PDFs points to a non-standard, likely malicious, purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8509

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/just-friends-chloe-jade-a-first-time-lesbian-romance-short.pdf
    • http://www.gorillawalker.com/atomic-and-nuclear-analytical-methods-xrf-m-ssbauer-xps-naa.pdf
    • http://www.gorillawalker.com/the-art-of-dying-the-only-book-for-persons-facing.pdf
    • http://www.gorillawalker.com/avery-ontiveros-corrada-selmi-and-hart-s-employment-discrimination-law.pdf
    • http://www.gorillawalker.com/the-shattering-of-the-soul-the-secret-sin-sexual-addiction.pdf
    • http://www.gorillawalker.com/alma-del-core-oboe-solo-with-piano-accompaniment.pdf
    • http://www.gorillawalker.com/low-carb-diet-to-go-healthy-and-delicious-under-30.pdf
    • http://www.gorillawalker.com/engaging-with-god-a-biblical-theology-of-worship.pdf
    • http://www.gorillawalker.com/learn-to-draw-disney-s-favorite-fairies-learn-to-draw.pdf
    • http://www.gorillawalker.com/10-steps-to-the-head-of-the-class-a-handbook.pdf
    • http://www.gorillawalker.com/the-science-of-real-time-data-capture-self-reports-in.pdf
    • http://www.gorillawalker.com/the-best-poems-of-the-english-language-from-chaucer-through.pdf
    • http://www.gorillawalker.com/aging-in-place-the-role-of-housing-and-social-supports.pdf
    • http://www.gorillawalker.com/orehaongakutuuorenimakaseronorebyu-haorenimakasero-japanese-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/the-legal-exploits-of-randolph-mason.pdf
    • http://www.gorillawalker.com/rapid-review-histology-and-cell-biology-with-student-consult-online.pdf
    • http://www.gorillawalker.com/ancient-egypt-transformed-the-middle-kingdom.pdf
    • http://www.gorillawalker.com/information-technologies-in-biomedicine-advances-in-intelligent-and-soft-computing.pdf
    • http://www.gorillawalker.com/capital-punishment-in-america-a-balanced-examination.pdf
    • http://www.gorillawalker.com/abc-s-write-and-wipe-lowercase-letters-kumon-flash-cards.pdf
    • http://www.gorillawalker.com/amana-colonies-gd-din-lodg-tour-97.pdf
    • http://www.gorillawalker.com/missa-sancti-nicolai-full-score-full-score-faber-edition.pdf
    • http://www.gorillawalker.com/ukraina-zachodnia-1-500-000-i-lw-w-1-10.pdf
    • http://www.gorillawalker.com/history-of-fredericksburg-virginia.pdf
    • http://www.gorillawalker.com/john-adams-founding-fathers.pdf
    • http://www.gorillawalker.com/euryanthe-opera-vocal-score-elibron-classics-replica-edition.pdf
    • http://www.gorillawalker.com/walkable-city-how-downtown-can-save-america-one-step-at.pdf
    • http://www.gorillawalker.com/the-medical-detectives-volume-ii.pdf
    • http://www.gorillawalker.com/people-s-history-of-sports-in-the-united-states-250.pdf
    • http://www.gorillawalker.com/clear-water-lotus-prayer-book-silent-prayers-for-daily-chanting.pdf
    • http://www.gorillawalker.com/a-child-s-garden-of-prayers-a-collection-of-classic.pdf
    • http://www.gorillawalker.com/landscape-planning-for-energy-conservation.pdf
    • http://www.gorillawalker.com/melissa-s-saving-grace-corbin-s-bend-season-three.pdf
    • http://www.gorillawalker.com/water-music-for-organ.pdf
    • http://www.gorillawalker.com/fighting-corruption-in-public-procurement-a-comparative-analysis-of-disqualification.pdf
    • http://www.gorillawalker.com/the-s-t-a-b-l-e-program-learner-provider.pdf
    • http://www.gorillawalker.com/the-sequential-intercept-model-and-criminal-justice-promoting-community-alternatives.pdf
    • http://www.gorillawalker.com/methods-of-algebraic-geometry-in-control-theory-part-i-scalar.pdf
    • http://www.gorillawalker.com/dead-cert-bull-s-eye.pdf
    • http://www.gorillawalker.com/jean-piaget-bloomsbury-library-of-educational-thought.pdf
    • http://www.gorillawalker.com/avery-ontiveros-corrada-selmi-and-hart-s-employme
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.