Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c7ef888b0a78043…

MALICIOUS

PDF

44.8 KB Created: 2018-11-23 21:03:19 +03:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.16)
MD5: 719d6792a6efcb12c31454f3b93a637d SHA-1: 96ebbe720acd3102c84759cc3922af5fda9ce77f SHA-256: 8c7ef888b0a780436cbe596848d475417b13e82aec164ee81dcd80a8f32f3f91
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF was flagged by a machine learning classifier as malicious and contains a large number of external links, indicating a link farm. The primary heuristic identified a mass external PDF link farm with 32 links, suggesting the document's purpose is to direct users to these external resources. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9005

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/visit-to-the-holy-land-egypt-and-italy-national-illustrated.pdf
    • http://www.gorillawalker.com/an-invitation-to-chess-a-picture-guide-to-the-royal.pdf
    • http://www.gorillawalker.com/paleo-recipes-for-beginners-180-recipes-of-quick-easy-cooking.pdf
    • http://www.gorillawalker.com/vincent-van-gogh-portrait-of-an-artist-kindle-edition.pdf
    • http://www.gorillawalker.com/the-last-tsar-emperor-michael-ii.pdf
    • http://www.gorillawalker.com/biochemistry-a-short-course-2nd-edition.pdf
    • http://www.gorillawalker.com/embriologia-libros-de-medicina-spanish-edition.pdf
    • http://www.gorillawalker.com/precursor-book-four-of-foreigner.pdf
    • http://www.gorillawalker.com/parents-make-the-difference-nourishing-literacy-development-through-shared-book.pdf
    • http://www.gorillawalker.com/criminal-investigation-the-art-and-the-science-6th-edition.pdf
    • http://www.gorillawalker.com/the-collected-works-of-g-k-chesterton-vol-1-heretics.pdf
    • http://www.gorillawalker.com/business-to-business-marketing-relationships-networks-and-strategies.pdf
    • http://www.gorillawalker.com/rk-narayan-reflections-and-re-evaluation.pdf
    • http://www.gorillawalker.com/sedimentation-and-tectonics-in-rift-basins-red-sea-gulf-of.pdf
    • http://www.gorillawalker.com/thomas-jefferson-passionate-pilgrim-the-presidency-the-founding-of-the.pdf
    • http://www.gorillawalker.com/athens-apartment.pdf
    • http://www.gorillawalker.com/adventures-in-bookbinding-handcrafting-mixed-media-books-by-stein-jeannine.pdf
    • http://www.gorillawalker.com/bite-the-dust-blood-and-moonlight-book-1.pdf
    • http://www.gorillawalker.com/ecg-signal-processing-classification-and-interpretation-a-comprehensive-framework-of.pdf
    • http://www.gorillawalker.com/art-and-language-of-jazz-vibes.pdf
    • http://www.gorillawalker.com/signature-style-creating-beautiful-interiors.pdf
    • http://www.gorillawalker.com/flavours-of-byzantium-none.pdf
    • http://www.gorillawalker.com/northern-dodecanese-kalymnos-telendos-leros-pamos-lipsi-arki-agathonisi-mcgilchrist.pdf
    • http://www.gorillawalker.com/nootropics-boost-your-brainpower-increase-your-memory-iq-happiness-level.pdf
    • http://www.gorillawalker.com/mouse-or-rat-translation-as-negotiation.pdf
    • http://www.gorillawalker.com/winged-faith-rethinking-globalization-and-religious-pluralism-through-the-sathya.pdf
    • http://www.gorillawalker.com/bipolar-disorder-rebuilding-your-life.pdf
    • http://www.gorillawalker.com/the-tiny-book-of-tiny-stories-volume-2.pdf
    • http://www.gorillawalker.com/hawaii-the-fake-state-a-nation-in-captivity.pdf
    • http://www.gorillawalker.com/managing-science-methodology-and-organization-of-research-innovation-technology-and.pdf
    • http://www.gorillawalker.com/myself-and-the-other-fellow-a-life-of-robert-louis.pdf
    • http://www.gorillawalker.com/policing-cinema-movies-and-censorship-in-early-twentieth-century-america.pdf
    • http://www.gorillawalker.com/the-good-behaviour-book-to-have-a-better-behaved-child.pdf
    • http://www.gorillawalker.com/teachers-of-the-inner-chambers-women-and-culture-in-seventeenth.pdf
    • http://www.gorillawalker.com/rear-view-a-brief-and-elegant-history-of-bottoms-through.pdf
    • http://www.gorillawalker.com/the-dreamer-and-the-fantasy-relationship-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/super-ben-s-broken-cookie-a-book-about-sharing-character.pdf
    • http://www.gorillawalker.com/improve-your-scales-piano-grade-5-a-workbook-for-examinations.pdf
    • http://www.gorillawalker.com/ill-wind-heather-warden-book-one.pdf
    • http://www.gorillawalker.com/southeast-and-southern-england-geomorphology-of-the-british-isles.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.