Malicious PDF — malware analysis report

Static analysis result for SHA-256 942c7a045b5b37f0…

MALICIOUS

PDF

42.1 KB Created: 2018-12-02 20:59:12 +03:00 Authoring application: Adobe InDesign CC (Macintosh) (via Adobe PDF Library 11.0)
MD5: 35d38306c1f2a05734699770e54b393f SHA-1: 6ee0c4abbcd340da905800a415aeab02f8b2281e SHA-256: 942c7a045b5b37f09a1152db123a90f12bc37521a1a637dcd05353ac828eedf7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a significant number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a link farm or content distribution network. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9041

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-for-sale-by-owner-handbook.pdf
    • http://www.gorillawalker.com/spin-control-kindle-edition.pdf
    • http://www.gorillawalker.com/crescent-over-another-horizon-islam-in-latin-america-the-caribbean.pdf
    • http://www.gorillawalker.com/chippendales-the-naked-truth-kindle-edition.pdf
    • http://www.gorillawalker.com/audi-tt-performance-portfolio-1998-2006.pdf
    • http://www.gorillawalker.com/northern-forest-canoe-trail-allagash-region-south-maine-umbazooksus-stream.pdf
    • http://www.gorillawalker.com/the-box-that-watch-found-the-boxcar-children-mysteries-113.pdf
    • http://www.gorillawalker.com/nature-s-engraver.pdf
    • http://www.gorillawalker.com/activins-and-inhibins-volume-85-vitamins-and-hormones.pdf
    • http://www.gorillawalker.com/wolfe-and-his-bunny-siren-publishing-classic-manlove.pdf
    • http://www.gorillawalker.com/terapia-con-los-chakras-spanish-edition.pdf
    • http://www.gorillawalker.com/antologia-de-la-literatura-espanola-edad-media-spanish-edition.pdf
    • http://www.gorillawalker.com/the-complete-master-cleanse-a-step-by-step-guide-to.pdf
    • http://www.gorillawalker.com/il-bambino-iperattivo-dalla-teoria-alle-pratiche-della-cura-jonas.pdf
    • http://www.gorillawalker.com/the-total-money-makeover-chinese-edition.pdf
    • http://www.gorillawalker.com/ningenryokuwo-minitukeruniwa-zeamiwoyomou-japanese-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/symphonic-dance-no-3-fiesta-belwin-classic-band.pdf
    • http://www.gorillawalker.com/time-was-soft-there-a-paris-sojourn-at-shakespeare-co.pdf
    • http://www.gorillawalker.com/a-creative-approach-to-music-fundamentals-with-cd-rom.pdf
    • http://www.gorillawalker.com/pavn-peoples-army-of-vietnam.pdf
    • http://www.gorillawalker.com/hunters-guide-to-whitetail-rifles.pdf
    • http://www.gorillawalker.com/scholastic-almanac-for-kids-2010-edition.pdf
    • http://www.gorillawalker.com/angels-of-desire-esoteric-bodies-aesthetics-and-ethics-gnostica.pdf
    • http://www.gorillawalker.com/south-asian-buddhism-a-survey-kindle-edition.pdf
    • http://www.gorillawalker.com/ingles-juridico-norteamericano-spanish-edition.pdf
    • http://www.gorillawalker.com/shooting-the-moon.pdf
    • http://www.gorillawalker.com/anthropology-art-and-aesthetics-oxford-studies-in-social-and-cultural.pdf
    • http://www.gorillawalker.com/italian-songs-for-accordion.pdf
    • http://www.gorillawalker.com/before-the-patch-book-one-a-devil-call-mc-book.pdf
    • http://www.gorillawalker.com/office-practice-basic-business-studies.pdf
    • http://www.gorillawalker.com/the-bicycle-artisans.pdf
    • http://www.gorillawalker.com/the-book-of-wingsuit-formations-kindle-edition.pdf
    • http://www.gorillawalker.com/book-of-common-prayer-and-administration-of-the-sacraments.pdf
    • http://www.gorillawalker.com/elaine-feinstein-collected-poems-and-translations-poetry-pleiade.pdf
    • http://www.gorillawalker.com/aprende-a-dibujar-comic-4-learn-to-draw-comic-creacion.pdf
    • http://www.gorillawalker.com/love-on-line-contents.pdf
    • http://www.gorillawalker.com/la-custode-del-miele-e-delle-api-italian-edition.pdf
    • http://www.gorillawalker.com/darjeeling-the-colorful-history-and-precarious-fate-of-the-world.pdf
    • http://www.gorillawalker.com/the-battle-of-penang-world-war-one-in-the-far.pdf
    • http://www.gorillawalker.com/2003-canis-lupus-sierra-high-school-yearbook-manteca-california.pdf
    • http://www.gorillawalker.com/terapia-con-los-chakras-spanish-editio
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.