Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e5dbd477d110e81…

MALICIOUS

PDF

41.4 KB Created: 2018-11-15 19:34:03 +03:00 Authoring application: Microsoft® Word 2016
MD5: fa776683161066c735e52e165fb75ec4 SHA-1: e9799d179bb2e42e69a4e3943c7ff9be59117d49 SHA-256: 8e5dbd477d110e81cba7fdd06ec9f4674af0d037cb972f6359b67c5ef83a9f1a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The document body is heavily obfuscated, but the presence of numerous links suggests a malicious intent, possibly to drive traffic to malicious sites or for SEO poisoning. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-last-lecture-kindle-edition.pdf
    • http://www.gorillawalker.com/el-capit-n-calzoncillos-y-el-diab-lico-desquite-del.pdf
    • http://www.gorillawalker.com/fired-up-book-one-of-the-dreamlight-trilogy-hardcover.pdf
    • http://www.gorillawalker.com/advanced-reservoir-management-and-engineering-second-edition.pdf
    • http://www.gorillawalker.com/tennessee-whitewater.pdf
    • http://www.gorillawalker.com/timothy-letters-to-all-the-bible-teaches-about-kindle-edition.pdf
    • http://www.gorillawalker.com/the-wonderful-world-of-polar-bears-your-child-s-first.pdf
    • http://www.gorillawalker.com/the-infatuations.pdf
    • http://www.gorillawalker.com/six-sigma-green-belt-round-2-making-your-next-project.pdf
    • http://www.gorillawalker.com/hazardous-waste-minimization-handbook.pdf
    • http://www.gorillawalker.com/on-to-mars-2-exploring-and-settling-a-new-world.pdf
    • http://www.gorillawalker.com/beating-the-street-chinese-edition.pdf
    • http://www.gorillawalker.com/yours-truly-johnny-dollar-vol-1.pdf
    • http://www.gorillawalker.com/the-alpha-chapter-7-bankruptcy-kit-special-book-edition-with.pdf
    • http://www.gorillawalker.com/a-ski-touring-guide-to-the-black-hills-of-south.pdf
    • http://www.gorillawalker.com/giving-it-all-to-jamal-deflowered.pdf
    • http://www.gorillawalker.com/wars-of-plunder-conflicts-profits-and-the-politics-of-resources.pdf
    • http://www.gorillawalker.com/a-lapsed-anarchist-s-approach-to-being-a-better-leader.pdf
    • http://www.gorillawalker.com/avicenna-his-life-and-works-routledge-library-editions-islamic-thought.pdf
    • http://www.gorillawalker.com/colonizing-mars-the-human-mission-to-the-red-planet-kindle.pdf
    • http://www.gorillawalker.com/modern-engineering-thermodynamics-textbook-with-tables-booklet.pdf
    • http://www.gorillawalker.com/walk-me-home.pdf
    • http://www.gorillawalker.com/words-of-want-presenting-poems-and-quotes.pdf
    • http://www.gorillawalker.com/extravaganza-mentalism-bizarre-magic-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/building-spelling-skills-grade-6.pdf
    • http://www.gorillawalker.com/examining-tuskegee-the-infamous-syphilis-study-and-its-legacy-the.pdf
    • http://www.gorillawalker.com/links-in-the-chain-shapers-of-the-jewish-tradition-oxford.pdf
    • http://www.gorillawalker.com/lizzie-beautiful-the-lizzie-vel-squez-story.pdf
    • http://www.gorillawalker.com/first-and-only-callaghan-brothers-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/my-big-machine-book.pdf
    • http://www.gorillawalker.com/business-man-s-guide-to-management-1937.pdf
    • http://www.gorillawalker.com/como-dibujar-comics-de-kung-fu.pdf
    • http://www.gorillawalker.com/will-you-be-there-choral-octavo-choir-written-and-composed.pdf
    • http://www.gorillawalker.com/right-for-a-reason-life-liberty-and-a-crapload-of.pdf
    • http://www.gorillawalker.com/kids-travel-journal-my-trip-to-bangladesh.pdf
    • http://www.gorillawalker.com/manor-of-death-a-domestic-bliss-mystery.pdf
    • http://www.gorillawalker.com/culture-shock-philippines-a-survival-guide-to-customs-and-etiquette.pdf
    • http://www.gorillawalker.com/day-by-day-with-daniel-the-illustrated-daniel-o-donnell.pdf
    • http://www.gorillawalker.com/introduction-to-political-psychology-by-cottam-martha-l-author-2009.pdf
    • http://www.gorillawalker.com/small-block-chevrolet-tuned-port-fuel-injection.pdf
    • http://www.gorillawalker.com/the-infatuations
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.