Malicious PDF — malware analysis report

Static analysis result for SHA-256 944c30dedfa259b0…

MALICIOUS

PDF

42.9 KB Created: 2019-02-14 08:25:57 +03:00 Authoring application: FrameMaker 7.2 (via Acrobat Distiller 7.0.5 (Windows)) First seen: 2019-02-20
MD5: d647b960d3df7b0dcd096b2adeaf80e2 SHA-1: c26b5c0c0c4beaee91d7f6f1d9a56bc121461420 SHA-256: 944c30dedfa259b06a33cc048eb3f1e5f42934fc6c0e05c3fc9a66171981ebe1
92 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains an embedded URL that points to another PDF file. The ML classifier flagged this PDF as malicious, suggesting it is part of a malicious distribution chain. The presence of an external URI and embedded URL indicates an attempt to redirect the user to malicious content. No scripts were extracted, limiting further analysis of the payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/a-little-bahamian-cook-book-little-cookbook.pdf In PDF document text
    • http://www.gorillawalker.com/erectile-dysfunction-the-ultimate-guide-to-cure-erectile-dysfunction-forever.pdfIn PDF document text
    • http://www.gorillawalker.com/new-crafts-papier-mache-25-creative-projects-shown-step-by.pdfIn PDF document text
    • http://www.gorillawalker.com/fresh-herb-companion-traditional-country-life-recipe-s.pdfIn PDF document text
    • http://www.gorillawalker.com/not-in-our-genes-pelican.pdfIn PDF document text
    • http://www.gorillawalker.com/change-the-way-you-see-everything-through-asset-based-thinking.pdfIn PDF document text
    • http://www.gorillawalker.com/methods-for-solving-systems-of-nonlinear-equations-cbms-nsf-regional.pdfIn PDF document text
    • http://www.gorillawalker.com/shopper-s-guide-1999-at-t-national-toll-free-directory.pdfIn PDF document text
    • http://www.gorillawalker.com/oil-and-gas-dictionary.pdfIn PDF document text
    • http://www.gorillawalker.com/international-air-power-review-vol-14.pdfIn PDF document text
    • http://www.gorillawalker.com/trace-learn-the-123s.pdfIn PDF document text
    • http://www.gorillawalker.com/navigate-2-advantage-access-for-health-care-finance-and-the.pdfIn PDF document text
    • http://www.gorillawalker.com/one-nation-under-therapy-how-the-helping-culture-is-eroding.pdfIn PDF document text
    • http://www.gorillawalker.com/incredible-reptiles-freestyle-express-incredible-creatures.pdfIn PDF document text
    • http://www.gorillawalker.com/multilingual-law-dictionary.pdfIn PDF document text
    • http://www.gorillawalker.com/tennessee-hill-folk-with-essay-by-jesse-stuart.pdfIn PDF document text
    • http://www.gorillawalker.com/la-dama-duende-teatro-spanish-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/amish-wedding-the-proposal-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/general-lavine-eccentric-piano-sheet-music-durand-s-a-editions.pdfIn PDF document text
    • http://www.gorillawalker.com/freud-s-rules-of-dream-interpretation.pdfIn PDF document text
    • http://www.gorillawalker.com/w-a-mozart-an-introduction-to-his-keyboard-works-editor.pdfIn PDF document text
    • http://www.gorillawalker.com/wallpaper-city-guide-copenhagen-2014-wallpaper-city-guides.pdfIn PDF document text
    • http://www.gorillawalker.com/keeping-the-republic-power-and-citizenship-in-american-politics-5th.pdfIn PDF document text
    • http://www.gorillawalker.com/bible-puzzles-memory-verse.pdfIn PDF document text
    • http://www.gorillawalker.com/a-little-night-music-libretto.pdfIn PDF document text
    • http://www.gorillawalker.com/salzburg-cityspots.pdfIn PDF document text
    • http://www.gorillawalker.com/great-source-write-source-texas-skillsbook-student-edition-grade-9.pdfIn PDF document text
    • http://www.gorillawalker.com/microbiology-laboratory-manual.pdfIn PDF document text
    • http://www.gorillawalker.com/love-quotes-365-love-quotes-the-best-love-quotes-to.pdfIn PDF document text
    • http://www.gorillawalker.com/hunting-the-dead-the-solenne-series-book-1-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/flywater-fly-fishing-rivers-of-the-west.pdfIn PDF document text
    • http://www.gorillawalker.com/pilate-before-jesus-and-other-biblical-and-legendary-poems-poems.pdfIn PDF document text
    • http://www.gorillawalker.com/the-musical-body-chakra-meditations-for-spiritual-exploration.pdfIn PDF document text
    • http://www.gorillawalker.com/the-unwritten-rules-of-copywriting-how-to-create-better-press.pdfIn PDF document text
    • http://www.gorillawalker.com/communion-of-saints-mystical-body-of-christ-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/fighting-men-of-the-indian-wars-a-biographical-encyclopedia-of.pdfIn PDF document text
    • http://www.gorillawalker.com/how-to-go-from-zero-to-13-2-million-in.pdfIn PDF document text
    • http://www.gorillawalker.com/maternal-neonatal-nursing-made-incredibly-easy-cd-rom-for-windows.pdfIn PDF document text
    • http://www.gorillawalker.com/the-heroes-and-mortals-of-greek-mythology-ancient-greek-mythology.pdfIn PDF document text
    • http://www.gorillawalker.com/are-we-there-yet-tales-from-the-never-ending-travels.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000d90.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD90 15805 bytes
SHA-256: 5dc729bdfc49e423225757805e43df9c80ad1e451d23b31b7d490bdd5067c3cf

Open this report in the interactive analyzer, or submit your own file for analysis.