Malicious PDF — malware analysis report

Static analysis result for SHA-256 89b538a033c8e5e4…

MALICIOUS

PDF

48.0 KB Created: 2018-12-14 21:25:56 +03:00 Authoring application: - (via Acrobat PDFWriter 3.02 for Windows NT)
MD5: 06d41bd0b4d9ecdf43b8cdd84aab99a7 SHA-1: 882bb1a38cfe899a385194893536393750025d0c SHA-256: 89b538a033c8e5e4140d1d6023c149a68b78f2605757ea75dad5bdc939fb3c79
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The embedded URLs suggest a link farm or a distribution mechanism for other malicious documents, potentially for SEO abuse or to host further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/set-the-table-11-designer-patterns-for-table-runners.pdf
    • http://www.gorillawalker.com/redshifted-martian-stories-third-flatiron-anthologies-book-7.pdf
    • http://www.gorillawalker.com/citizens-southern-bank-v-fayram-u-s-supreme-court-transcript.pdf
    • http://www.gorillawalker.com/the-founder-of-modern-egypt-a-study-of-muhammad-ali.pdf
    • http://www.gorillawalker.com/dry-or-wet.pdf
    • http://www.gorillawalker.com/high-performance-computing.pdf
    • http://www.gorillawalker.com/the-reformation-as-christianization-essays-on-scott-hendrix-s-christianization.pdf
    • http://www.gorillawalker.com/ceramic-integration-and-joining-technologies-from-macro-to-nanoscale.pdf
    • http://www.gorillawalker.com/outcome-measurement-and-management-first-steps-for-the-practicing-clinician.pdf
    • http://www.gorillawalker.com/second-language-pronunciation-attainment-and-assessment-european-university-studies-series.pdf
    • http://www.gorillawalker.com/men-s-travel-in-your-pocket-tours-accomodations-nightlife-for.pdf
    • http://www.gorillawalker.com/walking-with-the-mailman.pdf
    • http://www.gorillawalker.com/visual-merchandise-display.pdf
    • http://www.gorillawalker.com/bible-memory-verse-grace-little-charts.pdf
    • http://www.gorillawalker.com/faunal-extinction-in-an-island-society-pygmy-hippopotamus-hunters-of.pdf
    • http://www.gorillawalker.com/medical-terminology-audiolearn-a-complete-medical-terminology-audio-course-on.pdf
    • http://www.gorillawalker.com/anti-aging-homemade-remedies-and-recipes-age-gracefully-look-younger.pdf
    • http://www.gorillawalker.com/psychological-methods-of-pain-control-basic-science-and-clinical-perspectives.pdf
    • http://www.gorillawalker.com/5-hot-lesbian-erotic-stories-kindle-edition.pdf
    • http://www.gorillawalker.com/the-hypocrites-a-cia-mossad-road-map-of-iran.pdf
    • http://www.gorillawalker.com/dealing-with-deindustrialization-adaptive-resilience-in-american-midwestern-regions-routledge.pdf
    • http://www.gorillawalker.com/guidance-for-governance-comparing-alternative-sources-of-public-policy-advice.pdf
    • http://www.gorillawalker.com/bupropion-xl-useful-for-adult-adhd-adult-psychiatry-attention-deficit.pdf
    • http://www.gorillawalker.com/miriam-s-kitchen-a-memoir-hardcover-edition.pdf
    • http://www.gorillawalker.com/tornado-survival-prepare-for-survive-a-tornado-urban-survival-series.pdf
    • http://www.gorillawalker.com/walking-dead-99-1st-print-something-to-fear.pdf
    • http://www.gorillawalker.com/saxon-math-1-an-incremental-development-part-1-and-2.pdf
    • http://www.gorillawalker.com/the-journal-of-nuclear-medicine-jnm-volume-36-number-8.pdf
    • http://www.gorillawalker.com/cobler-146-s-hornpipe-founded-on-the-english-folk-dance.pdf
    • http://www.gorillawalker.com/paper-fun-for-kids-step-by-step.pdf
    • http://www.gorillawalker.com/what-does-the-school-nurse-do-jobs-in-my-school.pdf
    • http://www.gorillawalker.com/you-can-t-use-your-brain-if-you-re-a.pdf
    • http://www.gorillawalker.com/el-corazon-de-voltaire-spanish-edition-la-otra-orilla.pdf
    • http://www.gorillawalker.com/the-scotch.pdf
    • http://www.gorillawalker.com/e-study-guide-for-woelfels-dental-anatomy-dentistry-dentistry-kindle.pdf
    • http://www.gorillawalker.com/uni-in-the-usa-the-definitive-uk-guide-to-universities.pdf
    • http://www.gorillawalker.com/the-essential-dysphagia-handbook-real-life-decisions-mindmapping-and-more.pdf
    • http://www.gorillawalker.com/urban-operations-plus-ranger-survival.pdf
    • http://www.gorillawalker.com/how-to-make-a-fortune-today-starting-from-scratch-nickerson.pdf
    • http://www.gorillawalker.com/understanding-your-health.pdf
    • http://www.gorillawalker.com/hig
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.