Malicious PDF — malware analysis report

Static analysis result for SHA-256 912212c785e6fa0b…

MALICIOUS

PDF

41.4 KB Created: 2019-02-13 19:52:58 +03:00 Authoring application: Adobe InDesign CS6 (Macintosh) (via 3-Heights(TM) PDF Optimization Shell 4.6.23.0 (http://www.pdf-tools.com))
MD5: 994513e86165dde5605146e19eb65d43 SHA-1: b689c69482260a28ebc2df1edcfd2b3c49291a38 SHA-256: 912212c785e6fa0ba133d9087f778c027107d8769ec5f1a7dc4993fd59c30d02
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF was flagged by a machine learning classifier as malicious and contains a heuristic indicating a large number of embedded external links. The document body is heavily obfuscated, preventing a clear understanding of its direct purpose. However, the sheer volume of links suggests a link farm or SEO poisoning attack. The presence of embedded URLs points to the MITRE technique T1059.001 (PowerShell), though the specific script execution is not detailed.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/minorities-and-education-in-multicultural-japan-an-interactive-perspective.pdf
    • http://www.gorillawalker.com/my-first-book-of-jewish-holidays-artscroll-youth.pdf
    • http://www.gorillawalker.com/how-to-shape-bake-no-knead-dinner-sandwich-rolls-from.pdf
    • http://www.gorillawalker.com/general-theory-of-markov-processes-volume-133-pure-and-applied.pdf
    • http://www.gorillawalker.com/french-music-from-the-death-of-berlioz-to-the-death.pdf
    • http://www.gorillawalker.com/psych-k-the-missing-peace-in-your-life.pdf
    • http://www.gorillawalker.com/recovering-the-icon-the-life-and-works-of-leonid-ouspensky.pdf
    • http://www.gorillawalker.com/wind-pumping-a-handbook-world-bank-technical-paper.pdf
    • http://www.gorillawalker.com/beyond-the-mirage-think-and-lead-strategically-to-realize-the.pdf
    • http://www.gorillawalker.com/botanicals-butterflies-insects.pdf
    • http://www.gorillawalker.com/kids-draw-angels-elves-fairies-more.pdf
    • http://www.gorillawalker.com/campbell-s-casseroles-shaped-cookbook.pdf
    • http://www.gorillawalker.com/french-in-action-a-beginning-course-in-language-and-culture.pdf
    • http://www.gorillawalker.com/laravel-design-patterns-and-best-practices.pdf
    • http://www.gorillawalker.com/introduction-to-signal-integrity-a-laboratory-manual.pdf
    • http://www.gorillawalker.com/lonely-power-why-russia-has-failed-to-become-the-west.pdf
    • http://www.gorillawalker.com/la-celestina-fbula-spanish-edition.pdf
    • http://www.gorillawalker.com/southwestern-cooking.pdf
    • http://www.gorillawalker.com/ample-delights.pdf
    • http://www.gorillawalker.com/tourism-in-china-policy-and-development-since-1949-contemporary-geographies.pdf
    • http://www.gorillawalker.com/weekly-meditations-rudolf-steiner-s-calendar-of-the-soul-with.pdf
    • http://www.gorillawalker.com/krishnamurti-a-biography.pdf
    • http://www.gorillawalker.com/exploring-the-constitutionality-of-commercial-speech-a-view-of-tobacco.pdf
    • http://www.gorillawalker.com/rigby-on-our-way-to-english-bookroom-package-grade-2.pdf
    • http://www.gorillawalker.com/warm-words-otherwise-a-blizzard-of-book-reviews-kindle-edition.pdf
    • http://www.gorillawalker.com/high-yield-imaging-chest-expert-consult-online-and-print-1e.pdf
    • http://www.gorillawalker.com/these-things-are-written-an-introduction-to-the-religious-ideas.pdf
    • http://www.gorillawalker.com/natural-fibers-biopolymers-and-biocomposites.pdf
    • http://www.gorillawalker.com/building-beautiful-voices.pdf
    • http://www.gorillawalker.com/the-handbook-of-skiing-rev.pdf
    • http://www.gorillawalker.com/design-of-prestressed-concrete.pdf
    • http://www.gorillawalker.com/the-gatekeepers-inside-the-admissions-process-of-a-premier-college.pdf
    • http://www.gorillawalker.com/mannerheim-president-soldier-spy-kindle-edition.pdf
    • http://www.gorillawalker.com/looking-back-whatever-did-i-miss.pdf
    • http://www.gorillawalker.com/angry-management.pdf
    • http://www.gorillawalker.com/umbria-and-the-marches-marco-polo-map-marco-polo-maps.pdf
    • http://www.gorillawalker.com/human-geography-culture-society-and-space.pdf
    • http://www.gorillawalker.com/teacher-nurture-my-heart-igniting-the-greatness-of-every-student.pdf
    • http://www.gorillawalker.com/popular-mechanics-gadget-planet-150-gizmos-inventions-that-changed-the.pdf
    • http://www.gorillawalker.com/criminal-justice-today-an-introductory-text-for-the-21st-century.pdf
    • http://www.gorillawalker.com/general-theory-of-markov-processes-volume-133-pure-an
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://www.pdf-tools.com
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.