Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b73e3a1069bc942…

MALICIOUS

PDF

45.9 KB Created: 2019-01-06 08:24:32 +03:00 Authoring application: - (via Adobe Acrobat 10.0 Paper Capture Plug-in)
MD5: 3cf9b8fa4f5845d13b59b9d04100ee2e SHA-1: cbf8fe9e90e03d987abfdaec300c85262024dfaf SHA-256: 8b73e3a1069bc942e64297791d103f5c76db943df10242fd80a433e3dce9945a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/along-the-way-book-one-welcome-to-alberta.pdf
    • http://www.gorillawalker.com/paris-notebooks-a-selection-of-her-non-fiction.pdf
    • http://www.gorillawalker.com/to-heaven-and-back-a-doctor-s-extraordinary-account-of.pdf
    • http://www.gorillawalker.com/iec-60317-35-ed-1-2-b-2000-specifications-for.pdf
    • http://www.gorillawalker.com/murray-n-rothbard-vs-the-philosophers-unpublished-writings-on-hayek.pdf
    • http://www.gorillawalker.com/hold-em-or-fold-em-an-algorithm-for-making-the.pdf
    • http://www.gorillawalker.com/tillman-franks-i-was-there-when-it-happened.pdf
    • http://www.gorillawalker.com/the-principles-and-practice-of-horse-shoeing.pdf
    • http://www.gorillawalker.com/nanotechnology-for-coatings-european-coatings-tech-files.pdf
    • http://www.gorillawalker.com/the-book-of-blessings.pdf
    • http://www.gorillawalker.com/raspberry-recipes-top-50-most-delicious-raspberry-recipes-recipe-top.pdf
    • http://www.gorillawalker.com/communism-political-systems-of-the-world.pdf
    • http://www.gorillawalker.com/short-walks-from-bogot.pdf
    • http://www.gorillawalker.com/bluegrass-confederate-the-headquarters-diary-of-edward-o-guerrant-book.pdf
    • http://www.gorillawalker.com/how-to-raise-three-dragons-with-audio-recording-how-to.pdf
    • http://www.gorillawalker.com/lighthouses-of-the-world-2001-calendar.pdf
    • http://www.gorillawalker.com/how-i-escaped-from-gilligan-s-island-and-other-misadventures.pdf
    • http://www.gorillawalker.com/the-new-interpreter-s-study-bible-new-revised-standard-version.pdf
    • http://www.gorillawalker.com/double-grace-kindle-edition.pdf
    • http://www.gorillawalker.com/college-sex-pictures-3-college-sex-pictures-for-adult-erotic.pdf
    • http://www.gorillawalker.com/i-cannot-be-loved-the-life-and-times-of-cain.pdf
    • http://www.gorillawalker.com/spectacular-spiders.pdf
    • http://www.gorillawalker.com/suffolk-west-the-buildings-of-england-pevsner-architectural-guides.pdf
    • http://www.gorillawalker.com/adventures-in-orthodoxy.pdf
    • http://www.gorillawalker.com/who-put-the-beef-in-wellington-50-culinary-classics-who.pdf
    • http://www.gorillawalker.com/the-york-corpus-christi-plays-middle-english-texts.pdf
    • http://www.gorillawalker.com/the-butt-freak-blues.pdf
    • http://www.gorillawalker.com/trafficking-and-prostitution-reconsidered-second-edition-new-perspectives-on-migration.pdf
    • http://www.gorillawalker.com/the-impossible-musical-the-man-of-la-mancha-story.pdf
    • http://www.gorillawalker.com/virtual-clinical-excursions-3-0-for-foundations-of-psychiatric-mental.pdf
    • http://www.gorillawalker.com/martha-grimes-walks-into-a-pub-essays-on-a-writer.pdf
    • http://www.gorillawalker.com/health-maintenance-and-principal-microbial-diseases-of-cultured-fishes.pdf
    • http://www.gorillawalker.com/the-associated-press-stylebook-2013-associated-press-stylebook-and-briefing.pdf
    • http://www.gorillawalker.com/liquid-crystalline-polymers.pdf
    • http://www.gorillawalker.com/pkg-cyclopedic-medical-dictionary-index-22e-tabers-dvd-elec-med.pdf
    • http://www.gorillawalker.com/handbook-of-plastics-elastomers-composites-handbook.pdf
    • http://www.gorillawalker.com/fy-mywyd-fel-mwslim-cyfres-o-r-dechrau-i-r.pdf
    • http://www.gorillawalker.com/encyclopedia-of-distances.pdf
    • http://www.gorillawalker.com/pathfinder-map-pack-boarding-action.pdf
    • http://www.gorillawalker.com/growing-tension-hot-interracial-bwwm-office-sex-erotica-from-steam.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.