Malicious PDF — malware analysis report

Static analysis result for SHA-256 885ce04902f1590c…

MALICIOUS

PDF

42.1 KB Created: 2018-11-30 20:25:04 +03:00 Authoring application: Adobe InDesign CS3 (5.0) (via Adobe PDF Library 8.0)
MD5: ca62e7a9f27b38cb9a64c207c9ac1614 SHA-1: 48d2457f199597f157717f20a7bceb7e2ae3b6b1 SHA-256: 885ce04902f1590c18c3975cf59b0fae8ec61d8fa498231ddfa2820f2bf2e3d6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily obfuscated and unreadable, the presence of 32 external links suggests a malicious intent, likely for SEO manipulation or to serve as a lure for users to click on potentially harmful URLs. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8469

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-global-cities-reader-routledge-urban-reader-series.pdf
    • http://www.gorillawalker.com/neymar.pdf
    • http://www.gorillawalker.com/a-breath-of-silence-a-vampire-story.pdf
    • http://www.gorillawalker.com/there-s-only-one-way-to-win.pdf
    • http://www.gorillawalker.com/tower-of-basel-the-shadowy-history-of-the-secret-bank.pdf
    • http://www.gorillawalker.com/greatest-moments-of-cricket.pdf
    • http://www.gorillawalker.com/how-to-sell-at-margins-higher-than-your-competitors-winning.pdf
    • http://www.gorillawalker.com/diabetes-snacks-treats-and-easy-eats-for-kids-130-recipes.pdf
    • http://www.gorillawalker.com/guide-to-electronic-music.pdf
    • http://www.gorillawalker.com/caribbean-desserts.pdf
    • http://www.gorillawalker.com/basic-concepts-in-embryology-a-student-s-survival-guide-1st.pdf
    • http://www.gorillawalker.com/first-lessons-in-ballet.pdf
    • http://www.gorillawalker.com/rio-de-janeiro-in-3-days-a-72-hours-perfect.pdf
    • http://www.gorillawalker.com/the-next-generation-of-leaders-omar-dyer-for-public-office.pdf
    • http://www.gorillawalker.com/sweet-southern-a-heritage-of-beloved-desserts.pdf
    • http://www.gorillawalker.com/collected-writings-of-h-p-blavatsky-vol-9-1888.pdf
    • http://www.gorillawalker.com/nepotism-in-organizations-siop-organizational-frontiers-series.pdf
    • http://www.gorillawalker.com/central-asia-at-the-end-of-the-transition.pdf
    • http://www.gorillawalker.com/journal-of-chemical-physics-vol-47-no-6-15-september.pdf
    • http://www.gorillawalker.com/inside-steve-s-brain.pdf
    • http://www.gorillawalker.com/women-at-the-well.pdf
    • http://www.gorillawalker.com/industrial-marketing-research-management-and-technique-hardcover.pdf
    • http://www.gorillawalker.com/the-addendum.pdf
    • http://www.gorillawalker.com/the-light-of-the-fireflies-kindle-edition.pdf
    • http://www.gorillawalker.com/without-hope-a-childhood-ruined-by-the-man-she-should.pdf
    • http://www.gorillawalker.com/from-mission-to-modernity-evangelicals-reformers-and-education-in-nineteenth.pdf
    • http://www.gorillawalker.com/el-arte-de-la-conversacion-the-art-of-conversation-spanish.pdf
    • http://www.gorillawalker.com/conservation-of-wildlife-populations-demography-genetics-and-management.pdf
    • http://www.gorillawalker.com/elementos-de-farmacia-aplicada-a-la-medicina-obra-aprobada-i.pdf
    • http://www.gorillawalker.com/filipino-americans-one-nation-library-binding.pdf
    • http://www.gorillawalker.com/trust-no-one-the-glamorous-life-and-bizarre-death-of.pdf
    • http://www.gorillawalker.com/stoney-creek-alabama.pdf
    • http://www.gorillawalker.com/postcolonial-modernism-art-and-decolonization-in-twentieth-century-nigeria.pdf
    • http://www.gorillawalker.com/beating-about-the-nigerian-bush.pdf
    • http://www.gorillawalker.com/happy-endings-mccallister-s-paradise-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/prince2-agile.pdf
    • http://www.gorillawalker.com/striking-their-modern-pose-fashion-gender-and-modernity-in-gald.pdf
    • http://www.gorillawalker.com/american-urban-form-a-representative-history-urban-and-industrial-environments.pdf
    • http://www.gorillawalker.com/blackstone-s-statutes-on-family-law-2009-2010-blackstone-s.pdf
    • http://www.gorillawalker.com/caligula-divine-carnage.pdf
    • http://www.gorillawalker.com/diabetes-snacks-treats-and
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.