Malicious PDF — malware analysis report

Static analysis result for SHA-256 896a8dc3c751092e…

MALICIOUS

PDF

40.8 KB Created: 2018-12-02 10:56:18 +03:00 Authoring application: PageMaker 7.0 (via Acrobat Distiller 7.0 (Windows))
MD5: 45411ae42933cf73857fd6b128af5273 SHA-1: 7147b53caee0a87faba960dce099f38dd9f1d246 SHA-256: 896a8dc3c751092eacef9960c6caec5891b4abfeea313c5b2830040e4241ebdb
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier and contains a large number of embedded URLs, indicating a link farm or redirection scheme. The heuristic 'PDF_SEO_LINK_FARM' specifically points to a mass of external PDF links, suggesting an attempt to manipulate search engine results or distribute further malicious content. The presence of numerous unknown-reputation URLs supports this finding.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8227

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/questions-of-modern-chess-theory-chess-classics.pdf
    • http://www.gorillawalker.com/blind-eye-the-terrifying-story-of-a-doctor-who-got.pdf
    • http://www.gorillawalker.com/fairy-tales-english-and-russian-edition.pdf
    • http://www.gorillawalker.com/dictionary-of-category-words-vocabulary-building-english-word-power-volume.pdf
    • http://www.gorillawalker.com/john-lectio-divina-for-youth-lecto-divina-series.pdf
    • http://www.gorillawalker.com/basic-structural-behavior.pdf
    • http://www.gorillawalker.com/germany-profiled-syb-factbook.pdf
    • http://www.gorillawalker.com/the-age-of-scurvy-how-a-surgeon-a-mariner-and.pdf
    • http://www.gorillawalker.com/elementary-catechism-on-the-constitution-of-the-united-states.pdf
    • http://www.gorillawalker.com/dangerous-surrender-the-serafina-sin-city-series-volume-4.pdf
    • http://www.gorillawalker.com/who-was-here-discovering-wild-animal-tracks-millbrook-picture-books.pdf
    • http://www.gorillawalker.com/my-tooth-is-loose-the-sum-of-our-parts.pdf
    • http://www.gorillawalker.com/the-medicaid-handbook-2007-protecting-your-assets-from-nursing-home.pdf
    • http://www.gorillawalker.com/cookie-cracker-manufacturing-vol-1-second-edition.pdf
    • http://www.gorillawalker.com/the-ur-nammu-stela-university-museum-monographs.pdf
    • http://www.gorillawalker.com/a-vous-int-resse-tome-1-french-edition.pdf
    • http://www.gorillawalker.com/wet-mind-the-new-cognitive-neuroscience.pdf
    • http://www.gorillawalker.com/regional-bibliography-on-fisheries-and-aquaculture-in-southeast-asia-1985.pdf
    • http://www.gorillawalker.com/student-s-solutions-manual-college-algebra-concepts-through-functions.pdf
    • http://www.gorillawalker.com/the-mercy-rule-dismas-hardy-book-5.pdf
    • http://www.gorillawalker.com/mao-stalin-and-the-korean-war-trilateral-communist-relations-in.pdf
    • http://www.gorillawalker.com/the-yu-chi-stone.pdf
    • http://www.gorillawalker.com/petee-the-islander.pdf
    • http://www.gorillawalker.com/the-concepts-of-classical-thermodynamics-cambridge-monographs-on-physics.pdf
    • http://www.gorillawalker.com/business-mathematics-solution-key.pdf
    • http://www.gorillawalker.com/corpus-christi-the-legacy-chronicles-volume-1.pdf
    • http://www.gorillawalker.com/no-greater-evil.pdf
    • http://www.gorillawalker.com/reflexology-health-at-your-fingertips.pdf
    • http://www.gorillawalker.com/mental-illness-in-the-workplace-psychological-disability-management-psychological-and.pdf
    • http://www.gorillawalker.com/nursing-informatics-and-the-foundation-of-knowledge-kindle-edition.pdf
    • http://www.gorillawalker.com/the-europeanisation-of-remedies-and-procedures-through-judge-made-law.pdf
    • http://www.gorillawalker.com/life-tried-to-throw-me-a-curveball-i-overcame-diabetes.pdf
    • http://www.gorillawalker.com/the-right-to-look-a-counterhistory-of-visuality.pdf
    • http://www.gorillawalker.com/goddess-kindle-edition.pdf
    • http://www.gorillawalker.com/forbidden-archeology-s-impact-how-a-controversial-new-book-shocked.pdf
    • http://www.gorillawalker.com/george-whitefield-america-s-spiritual-founding-father.pdf
    • http://www.gorillawalker.com/twilight-at-monticello-the-final-years-of-thomas-jefferson.pdf
    • http://www.gorillawalker.com/advanced-topics-in-c-core-concepts-in-data-structures-expert.pdf
    • http://www.gorillawalker.com/crimson-embrace-6-a-gallery-girls-book-gallery-girls-collection.pdf
    • http://www.gorillawalker.com/kiss-the-night-goodbye-nikki-michael.pdf
    • http://www.gorillawalker.com/the-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.