Malicious PDF — malware analysis report

Static analysis result for SHA-256 88e0d873e316a004…

MALICIOUS

PDF

40.0 KB Created: 2018-12-03 17:09:28 +03:00 Authoring application: Acrobat PDFMaker 5.0 for Word (via Acrobat Distiller 5.0.5 (Windows))
MD5: ecda01b7c3607cd35809c7b070733c8a SHA-1: 2b6692caf350ed98fcc884d03e28f888fc34906d SHA-256: 88e0d873e316a0048991feb5604908ce0094548ad8a0c78ff83bd4a7fa4f2ade
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The document body, though heavily obfuscated, contains these same URLs, suggesting the primary purpose is to direct users to a link farm. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/lxx-isaiah-24-1-26-6-as-interpretation-and-translation.pdf
    • http://www.gorillawalker.com/so-you-think-you-know-scotland-extrordinary-facts-about-the.pdf
    • http://www.gorillawalker.com/verderben-die-macht-der-m-rder-german-edition.pdf
    • http://www.gorillawalker.com/enslaved.pdf
    • http://www.gorillawalker.com/grant-s-dissector.pdf
    • http://www.gorillawalker.com/radiation-curing-in-polymer-science-and-technology-volume-3-polymerisation.pdf
    • http://www.gorillawalker.com/lagos-city-guide-map.pdf
    • http://www.gorillawalker.com/jean-marie-tjibaou-kanak-witness-to-the-world-an-intellectual.pdf
    • http://www.gorillawalker.com/zoo-wild-animal-medicine-current-therapy-4.pdf
    • http://www.gorillawalker.com/the-vanishing-game-hardy-boys-adventures.pdf
    • http://www.gorillawalker.com/bob-artley-s-country-christmas-as-remembered-by-a-former.pdf
    • http://www.gorillawalker.com/the-spiritual-instructions-of-saint-seraphim-of-sarov.pdf
    • http://www.gorillawalker.com/white-water-nepal-a-rivers-guidebook-for-rafting-kayaking.pdf
    • http://www.gorillawalker.com/rand-mcnally-colorado-springs-colorado-rand-mcnally-city-maps.pdf
    • http://www.gorillawalker.com/over-the-edge-of-the-world-magellan-s-terrifying-circumnavigation.pdf
    • http://www.gorillawalker.com/girl-missing-previously-published-as-peggy-sue-got-murdered-a.pdf
    • http://www.gorillawalker.com/accounting-for-lawyers-university-casebook-series.pdf
    • http://www.gorillawalker.com/the-11-immutable-laws-of-internet-branding.pdf
    • http://www.gorillawalker.com/1000-miles-in-a-machilla-travel-and-sport-in-nyasaland.pdf
    • http://www.gorillawalker.com/an-adventurer-s-guide-to-number-theory-dover-books-on.pdf
    • http://www.gorillawalker.com/flat-out-awesome-knock-knock-jokes-for-kids.pdf
    • http://www.gorillawalker.com/the-lord-of-the-rings-instrumental-solos-horn-in-f.pdf
    • http://www.gorillawalker.com/the-larousse-book-of-bread-80-recipes-to-make-at.pdf
    • http://www.gorillawalker.com/new-criteria-debut-for-classifying-juvenile-systemic-sclerosis-an-article.pdf
    • http://www.gorillawalker.com/karma-effect-a-paranormal-romantic-comedy.pdf
    • http://www.gorillawalker.com/marriage-a-complete-solution.pdf
    • http://www.gorillawalker.com/still-whispering-after-all-these-years-my-autobiography.pdf
    • http://www.gorillawalker.com/cave-and-cosmos-shamanic-encounters-with-spirits-and-heavens-by.pdf
    • http://www.gorillawalker.com/moonlight-vines-vampire-cat.pdf
    • http://www.gorillawalker.com/design-of-normal-concrete-mixes-br-331-ci-sfb.pdf
    • http://www.gorillawalker.com/electric-generators-handbook-two-volume-set.pdf
    • http://www.gorillawalker.com/remembering-whitney.pdf
    • http://www.gorillawalker.com/capitalism-and-schizophrenia-in-the-later-novels-of-louis-ferdinand.pdf
    • http://www.gorillawalker.com/the-complete-idiot-s-guide-to-communicating-with-spirits-idiot.pdf
    • http://www.gorillawalker.com/nce-practice-questions-practice-tests-exam-review-for-the-national.pdf
    • http://www.gorillawalker.com/the-sheep-book-for-smallholders.pdf
    • http://www.gorillawalker.com/brave-new-words-a-language-lover-s-guide-to-the.pdf
    • http://www.gorillawalker.com/flame-of-recca-22-japanese-edition-flame-of-recca.pdf
    • http://www.gorillawalker.com/the-tourism-system.pdf
    • http://www.gorillawalker.com/living-by-the-book-video-series-workbook-20-part-extended.pdf
    • http://www.gorillawalk
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.