Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cff829b02d97303…

MALICIOUS

PDF

45.1 KB Created: 2018-12-15 20:02:22 +03:00 Authoring application: QuarkXPress: pictwpstops filter 1.0 (via Acrobat Distiller 6.0 for Macintosh)
MD5: 9f530f8f53fa33e7691c28fab4540fe5 SHA-1: 1e30ff4bfaa7a597a5ce1aa19844c8e4ef62c73d SHA-256: 8cff829b02d97303c5ba15def71da8daa5374d749884809800ec9ff67e5a4055
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs, forming a link farm. The primary heuristic firing, PDF_SEO_LINK_FARM, indicates that this is a technique used to artificially inflate search engine rankings or distribute traffic. While no malicious scripts were extracted, the sheer volume of links and the critical heuristic firing suggest a malicious intent, likely to direct users to potentially harmful content or to manipulate search results. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/remote-sensing-of-sea-ice-in-the-northern-sea-route.pdf
    • http://www.gorillawalker.com/between-scylla-and-charybdis-the-jews-in-sicily-brill-s.pdf
    • http://www.gorillawalker.com/ocr-as-biology-a-my-revision-notes.pdf
    • http://www.gorillawalker.com/perfect-risotto-a-delicious-celebration-of-italy-s-most-famous.pdf
    • http://www.gorillawalker.com/the-crc-s-guide-to-coordinating-clinical-research.pdf
    • http://www.gorillawalker.com/five-famous-writers-great-black-heroes.pdf
    • http://www.gorillawalker.com/52-chess-openings-playing-cards-english-spanish-and-french-edition.pdf
    • http://www.gorillawalker.com/experimental-psychology-methods-of-research.pdf
    • http://www.gorillawalker.com/the-power-of-alignment-how-great-companies-stay-centered-and.pdf
    • http://www.gorillawalker.com/managing-humans-biting-and-humorous-tales-of-a-software-engineering.pdf
    • http://www.gorillawalker.com/whole-foods-recipes-quick-easy-dinner-recipes-cookbook-for-heart.pdf
    • http://www.gorillawalker.com/exponential-how-you-and-your-friends-can-start-a-missional.pdf
    • http://www.gorillawalker.com/how-to-play-piano-everything-you-need-to-know-to.pdf
    • http://www.gorillawalker.com/a-crocodile-s-life-living-large.pdf
    • http://www.gorillawalker.com/beowulf-library-edition.pdf
    • http://www.gorillawalker.com/an-old-faith-in-the-new-world-portrait-of-shearith.pdf
    • http://www.gorillawalker.com/futanari-goddesses-hot-taboo-futanari-box-set.pdf
    • http://www.gorillawalker.com/the-cessation-of-delegated-power-1954.pdf
    • http://www.gorillawalker.com/how-connections-heal-stories-from-relational-cultural-therapy.pdf
    • http://www.gorillawalker.com/culinary-herbs-their-cultivation-harvesting-curing-and-uses.pdf
    • http://www.gorillawalker.com/fidelio-an-opera-in-two-acts.pdf
    • http://www.gorillawalker.com/let-your-worries-fly-away-unlock-your-life.pdf
    • http://www.gorillawalker.com/blackjack-betting-system-stay-and-play-for-free-counting-made.pdf
    • http://www.gorillawalker.com/arts-ministry-nurturing-the-creative-life-of-god-s-people.pdf
    • http://www.gorillawalker.com/the-case-for-decentralized-federalism-governance-series.pdf
    • http://www.gorillawalker.com/the-beginners-book-of-essential-oils-learning-to-use-your.pdf
    • http://www.gorillawalker.com/look-up-baltimore-5-walking-tours-in-charm-city-look.pdf
    • http://www.gorillawalker.com/spiritual-interrogations.pdf
    • http://www.gorillawalker.com/what-locals-know-about-wilmington-and-its-beaches-a-complete.pdf
    • http://www.gorillawalker.com/experimental-studies-of-transport-phenomena-in-highly-ionized-gases.pdf
    • http://www.gorillawalker.com/through-paediatrics-to-psycho-analysis-collected-papers.pdf
    • http://www.gorillawalker.com/asian-journeys-a-primer-for-the-independent-traveler.pdf
    • http://www.gorillawalker.com/sediments-of-time-environment-and-society-in-chinese-history-studies.pdf
    • http://www.gorillawalker.com/adalat-a-medical-dictionary-bibliography-and-annotated-research-guide-to.pdf
    • http://www.gorillawalker.com/my-name-is-mahtob-the-story-that-began-in-the.pdf
    • http://www.gorillawalker.com/theory-of-committees-and-elections.pdf
    • http://www.gorillawalker.com/essentials-of-physical-chemistry.pdf
    • http://www.gorillawalker.com/bugville-critters-save-their-allowance-bugville-critters-17.pdf
    • http://www.gorillawalker.com/isabel-allende-a-literary-companion-mcfarland-literary-companions.pdf
    • http://www.gorillawalker.com/agile-project-management-with-scrum-microsoft-professional-by-schwaber-ken.pdf
    • http://www.gorillawalker.com/52-chess-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.