Malicious PDF — malware analysis report

Static analysis result for SHA-256 95e56d69cc6a8973…

MALICIOUS

PDF

43.0 KB Created: 2019-03-17 09:10:22 +03:00 Authoring application: FrameMaker 10.0.2 (via Acrobat Distiller 11.0 (Windows))
MD5: 5f25c4dfbf4f6e904e3d39ce2acf1c44 SHA-1: 9d6f065e8b413d9c8f0a39bf0cc6cdab34e43150 SHA-256: 95e56d69cc6a8973fba551a783e700078d0910ab5293cfc3d6b1ff9f1da49ac1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged for containing a large number of external links, a technique often used for SEO manipulation or to distribute malicious content. The embedded URLs point to various PDF files hosted on the same domain, suggesting a link farm or a distribution point for further malicious activity. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/full-color-creative-editions.pdf
    • http://www.gorillawalker.com/polycentricity-and-local-public-economies-readings-from-the-workshop-in.pdf
    • http://www.gorillawalker.com/conversation-and-technology-from-the-telephone-to-the-internet.pdf
    • http://www.gorillawalker.com/is-our-gospel-the-gospel.pdf
    • http://www.gorillawalker.com/burning-bed-kindle-edition.pdf
    • http://www.gorillawalker.com/missa-in-angustiis-nelsonmesse-hob-xxii-11-vocal-score-latin.pdf
    • http://www.gorillawalker.com/china-tattoo.pdf
    • http://www.gorillawalker.com/introduction-to-micrometeorology-volume-79-second-edition-international-geophysics.pdf
    • http://www.gorillawalker.com/the-essential-epicurus-great-books-in-philosophy.pdf
    • http://www.gorillawalker.com/normal-healthy-aging-and-when-it-s-not-the-dementia.pdf
    • http://www.gorillawalker.com/the-jesus-legend.pdf
    • http://www.gorillawalker.com/back-to-school-sight-words-6-95-noun-flashcards-for.pdf
    • http://www.gorillawalker.com/non-verbal-reasoning-age-10-11-assessment-papers-letts-11.pdf
    • http://www.gorillawalker.com/high-court-case-summaries-on-torts-keyed-to-prosser-12th.pdf
    • http://www.gorillawalker.com/teatro-latinoamericano-y-vanguardia-spanish-edition.pdf
    • http://www.gorillawalker.com/scorpion-venoms-toxinology.pdf
    • http://www.gorillawalker.com/crete-west-rother-walking-guide.pdf
    • http://www.gorillawalker.com/learn-japanese-words-foreign-language-basics.pdf
    • http://www.gorillawalker.com/methods-of-achieving-improved-seismic-performance-of-communications-systems-american.pdf
    • http://www.gorillawalker.com/what-is-culture-our-multicultural-world.pdf
    • http://www.gorillawalker.com/the-three-little-women-and-the-big-bad-men-an.pdf
    • http://www.gorillawalker.com/the-complete-book-of-doo-wop-rhythm-and-blues.pdf
    • http://www.gorillawalker.com/workbook-calculus-matrices-and-vector-geometry-workbook-for-grade-12.pdf
    • http://www.gorillawalker.com/360-sound-the-columbia-records-story.pdf
    • http://www.gorillawalker.com/my-age-of-anxiety-fear-hope-dread-and-the-search.pdf
    • http://www.gorillawalker.com/on-writers-and-writing.pdf
    • http://www.gorillawalker.com/fifty-kinds-of-dead-fkod-book-1.pdf
    • http://www.gorillawalker.com/you-are-not-your-pain-using-mindfulness-to-relieve-pain.pdf
    • http://www.gorillawalker.com/the-exposition-on-the-province-of-new-mexico-1812.pdf
    • http://www.gorillawalker.com/diary-of-two-mad-black-mormons-finding-the-lord-s.pdf
    • http://www.gorillawalker.com/sustainability-and-cities-overcoming-automobile-dependence.pdf
    • http://www.gorillawalker.com/tai-chi-for-a-healthy-lifestyle.pdf
    • http://www.gorillawalker.com/hoover-s-secret-war-against-axis-spies-fbi-counterespionage-during.pdf
    • http://www.gorillawalker.com/tejas-traditions-a-texas-cookbook-kindle-edition.pdf
    • http://www.gorillawalker.com/explore-dallas-with-children-a-family-activities-guide.pdf
    • http://www.gorillawalker.com/medical-patent-law-the-challenges-of-medical-treatment.pdf
    • http://www.gorillawalker.com/rousseau-burke-and-revolution-in-france-1791-second-edition-reacting.pdf
    • http://www.gorillawalker.com/handbook-of-capillary-electrophoresis.pdf
    • http://www.gorillawalker.com/lil-y-minino-juegan-al-escondite-palabras-menudas-series.pdf
    • http://www.gorillawalker.com/dragons-and-bulls-profitable-investment-strategies-for-trading-stocks-and.pdf
    • http://www.gorillawalker.com/the-essential-epicurus-great-books-in-philosophy
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.