Malicious PDF — malware analysis report

Static analysis result for SHA-256 88973aa31d9bb323…

MALICIOUS

PDF

48.3 KB Created: 2018-12-02 20:18:28 +03:00 Authoring application: Writer (via OpenOffice.org 1.1.2)
MD5: d1057e3c229abf544f95c98c3aed7f01 SHA-1: 110a0bfba63bf223f7b85aef5bc015a4c0846106 SHA-256: 88973aa31d9bb323cd4805d1273d29ea50a358e427a18e2489a62d836b409582
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a large link farm of external PDF documents, indicating a non-standard purpose. The embedded URLs point to various book titles, suggesting a potential lure or SEO manipulation tactic. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the immediate payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8509

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/civil-engineering-fe-exam-preparation-workbook.pdf
    • http://www.gorillawalker.com/pmp-exam-pass-cheat-sheet-test-new-compatible-version-important.pdf
    • http://www.gorillawalker.com/clarinet-plus-2.pdf
    • http://www.gorillawalker.com/comprehensive-handbook-obstetrics-gynecology.pdf
    • http://www.gorillawalker.com/holt-lifetime-health-texas-edition.pdf
    • http://www.gorillawalker.com/the-tiger-queens-the-women-of-genghis-khan-kindle-edition.pdf
    • http://www.gorillawalker.com/naked-playwriting-the-art-the-craft-and-the-life-laid.pdf
    • http://www.gorillawalker.com/property-law-texas-southern-university-thurgood-marshall-school-of-law.pdf
    • http://www.gorillawalker.com/the-complete-crumb-comics-vol-5-happy-hippy-comix.pdf
    • http://www.gorillawalker.com/more-than-conquerors.pdf
    • http://www.gorillawalker.com/holt-african-american-literature-student-edition-grades-9-12-1998.pdf
    • http://www.gorillawalker.com/greek-island-hopping-2012.pdf
    • http://www.gorillawalker.com/social-media-integration-into-state-operated-fusion-centers-and-local.pdf
    • http://www.gorillawalker.com/sultan-in-arabia-a-private-life-kindle-edition.pdf
    • http://www.gorillawalker.com/the-badminton-library-of-sports-and-pastimes-classic-reprint.pdf
    • http://www.gorillawalker.com/stealing-america-what-my-experience-with-criminal-gangs-taught-me.pdf
    • http://www.gorillawalker.com/la-cocina-dominicana.pdf
    • http://www.gorillawalker.com/the-star-spangled-banner-written-by-francis-scott-key-illustrated.pdf
    • http://www.gorillawalker.com/the-american-cyclopaedia-a-popular-dictionary-of-general-knowledge-volume.pdf
    • http://www.gorillawalker.com/rand-mcnally-easyfinder-colorado-springs-colorado.pdf
    • http://www.gorillawalker.com/maracas-row-row-row-your-boat-rockin-rhythm-band-board.pdf
    • http://www.gorillawalker.com/carrera-panamericana-history-of-the-mexican-road-race-1950-1954.pdf
    • http://www.gorillawalker.com/people-s-choice-guide-cancun-2008-cancun-travel-guide-survey.pdf
    • http://www.gorillawalker.com/pacific-northwest-road-atlas-thomas-guide-pacific-northwest-road-atlas.pdf
    • http://www.gorillawalker.com/principal-assets-a-novel.pdf
    • http://www.gorillawalker.com/biographies-and-autobiographies-in-modern-italy-a-festschrift-for-john.pdf
    • http://www.gorillawalker.com/beginning-r-the-statistical-programming-language.pdf
    • http://www.gorillawalker.com/collected-papers-of-the-international-conferences-on-optical-fiber-sensors.pdf
    • http://www.gorillawalker.com/a-canoeing-guide-to-the-indian-head-rivers-of-west.pdf
    • http://www.gorillawalker.com/leading-at-the-edge-of-chaos-how-to-create-the.pdf
    • http://www.gorillawalker.com/paleo-diet-to-go-healthy-and-delicious-under-30-minute.pdf
    • http://www.gorillawalker.com/the-ethics-of-war-in-asian-civilizations-a-comparative-perspective.pdf
    • http://www.gorillawalker.com/techniques-in-organic-chemistry-miniscale-standard-taper-microscale-williamson-microscale.pdf
    • http://www.gorillawalker.com/australia-enchantment-of-the-world-second-series.pdf
    • http://www.gorillawalker.com/despues-de-la-guerra-after-the-war-alandar-spanish-edition.pdf
    • http://www.gorillawalker.com/fdtd-simulation-of-femtosecond-pulse-propagation-in-semiconductor-lasers.pdf
    • http://www.gorillawalker.com/pali-buddha-s-language-a-complete-teach-yourself-course-for.pdf
    • http://www.gorillawalker.com/learn-to-draw-planes-choppers-watercraft-step-by-step-instructions.pdf
    • http://www.gorillawalker.com/the-split-world-of-gerard-manley-hopkins-an-essay-in.pdf
    • http://www.gorillawalker.com/gods-man-a-novel-in-woodcuts-dover-fine-art-history.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.