Malicious PDF — malware analysis report

Static analysis result for SHA-256 9265f1fb5f4ba23e…

MALICIOUS

PDF

46.4 KB Created: 2018-11-26 20:12:18 +03:00 Authoring application: Acrobat PDFMaker 7.0 for Publisher (via Acrobat Distiller 7.0 (Windows))
MD5: f279716f93ad5e4b2a3b82e7afe463c7 SHA-1: d20f2fbecec33f50025ecd1534d339c9f9d5a4b8 SHA-256: 9265f1fb5f4ba23e7d4e82a9d845681fd265648913ef64fa041786480af4d03e
72 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains multiple embedded URLs pointing to external documents, suggesting a lure to download further content. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic indicates that the document likely instructs the user to open a password-protected archive, a common tactic to bypass gateway security. The ML classifier also flagged this PDF as malicious. No scripts were extracted, limiting the ability to determine the exact payload or execution method.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7752

Heuristics 3

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/defacement-public-secrecy-and-the-labor-of-the-negative.pdf
    • http://www.gorillawalker.com/borderline-personality-disorder-demystified-an-essential-guide-for-understanding-and.pdf
    • http://www.gorillawalker.com/ben-cohen-lives-and-times.pdf
    • http://www.gorillawalker.com/trouble-s-chtig-nach-dir-roman-german-edition.pdf
    • http://www.gorillawalker.com/salmon-farming-handbook.pdf
    • http://www.gorillawalker.com/to-free-a-family-the-journey-of-mary-walker.pdf
    • http://www.gorillawalker.com/taken.pdf
    • http://www.gorillawalker.com/beyond-born-oppenheimer-electronic-nonadiabatic-coupling-terms-and-conical-intersections.pdf
    • http://www.gorillawalker.com/the-abcs-of-getting-out-of-debt-turn-bad-debt.pdf
    • http://www.gorillawalker.com/el-golfista-y-el-millorario-spanish-edition.pdf
    • http://www.gorillawalker.com/verdad-mentira-true-or-false-la-respuesta-a-los-mitos.pdf
    • http://www.gorillawalker.com/the-discarded-a-jonathan-quinn-novel-volume-8.pdf
    • http://www.gorillawalker.com/worship-sketches-2-perform-a-collection-of-scripts-for-two.pdf
    • http://www.gorillawalker.com/ketogenic-diet-basics-a-miracle-for-weight-loss-the-ketogenic.pdf
    • http://www.gorillawalker.com/guangdong-s-new-energy-automotive-industry-and-to-promote-policy.pdf
    • http://www.gorillawalker.com/jouless-mermaid-journal-of-rare-exotic-seashells-a-field-guide.pdf
    • http://www.gorillawalker.com/the-second-oldest-profession-spies-and-spying-in-the-twentieth.pdf
    • http://www.gorillawalker.com/i-never-told-anyone-writings-by-women-survivors-of-child.pdf
    • http://www.gorillawalker.com/the-supreme-court-and-the-mass-media-selected-cases-summaries.pdf
    • http://www.gorillawalker.com/chemistry-intermediate-1-sqa-past-papers-2008.pdf
    • http://www.gorillawalker.com/the-sporting-clays-handbook.pdf
    • http://www.gorillawalker.com/becky-kelly-enchanted-little-moments-2010-mini-day-to-day.pdf
    • http://www.gorillawalker.com/serpent-numa-files.pdf
    • http://www.gorillawalker.com/safety-and-security-review-for-the-process-industries-application-of.pdf
    • http://www.gorillawalker.com/the-siren-mills-boon-spice-the-original-sinners-the-red.pdf
    • http://www.gorillawalker.com/the-illustrated-encyclopedia-of-animal-life-the-animal-kingdom-volume.pdf
    • http://www.gorillawalker.com/disgraced-a-play.pdf
    • http://www.gorillawalker.com/increasing-fluency-with-high-frequency-word-phrases-grade-5.pdf
    • http://www.gorillawalker.com/sermons-on-job.pdf
    • http://www.gorillawalker.com/chakras-handbook-for-beginners-diy-guide-to-balance-chakras-strengthen.pdf
    • http://www.gorillawalker.com/daniel-mohr-back-to-nature.pdf
    • http://www.gorillawalker.com/alvin-plantinga-and-christian-apologetics-paternoster-theological-monographs.pdf
    • http://www.gorillawalker.com/us-army-special-forces-technical-manual-tm-9-1240-369.pdf
    • http://www.gorillawalker.com/the-army-of-the-potomac.pdf
    • http://www.gorillawalker.com/mirage-book-two.pdf
    • http://www.gorillawalker.com/anno-s-counting-book-turtleback-school-library-binding-edition.pdf
    • http://www.gorillawalker.com/paper-craft-crazy-critters-papertoy-models-origami.pdf
    • http://www.gorillawalker.com/the-nuclear-enterprise-high-consequence-accidents-how-to-enhance-safety.pdf
    • http://www.gorillawalker.com/daily-lenten-meditations-prayerful-reflections-from-john-paul-ii.pdf
    • http://www.gorillawalker.com/analogia-simbolica-manual-de-terapia-regresiva-el-camino-secreto-del.pdf
    • http://www.gorillawalker.com/beyond-born-oppenheime
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.