Malicious PDF — malware analysis report

Static analysis result for SHA-256 9879b652d1981f00…

MALICIOUS

PDF

41.8 KB Created: 2018-11-30 20:35:47 +03:00 Authoring application: Acrobat Distiller 7.0.5 (Windows)
MD5: 044b4f42d3f2bd93d737c18c6f10f0c7 SHA-1: 461881632bd5b0c0cdba7c437600d4686ae50bde SHA-256: 9879b652d1981f00447b38ad3c744a389d22b432e2cab36c40089fa5f9c24f2f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The document body is heavily obfuscated, but the presence of numerous links suggests a link-farming or redirection attempt, likely to distribute further malicious content or engage in SEO abuse.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/flora-of-dorsetshire-or-a-catalogue-of-plants-found-in.pdf
    • http://www.gorillawalker.com/the-robot-dynamic-the-theory-of-banging-book-1.pdf
    • http://www.gorillawalker.com/good-beer-guide-breweries-and-pubs-of-the-pacific-northwest.pdf
    • http://www.gorillawalker.com/a-touch-morbid-touch-mortal-trilogy.pdf
    • http://www.gorillawalker.com/empire-z-game-how-to-download-for-kindle-fire-hd.pdf
    • http://www.gorillawalker.com/fast-simple-fresh-gluten-free-recipes-for-soups-appetizers-deliciously.pdf
    • http://www.gorillawalker.com/largemouth-bass-fish-game.pdf
    • http://www.gorillawalker.com/the-days-of-noah-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/the-politics-of-high-tech-growth-developmental-network-states-in.pdf
    • http://www.gorillawalker.com/7075-panzer-vor-7-concord-armor-at-war-series.pdf
    • http://www.gorillawalker.com/a-taste-for-hot-steel-frontline-encounters-of-a-foreign.pdf
    • http://www.gorillawalker.com/the-railway-detective-inspector-robert-colbeck.pdf
    • http://www.gorillawalker.com/the-secret-garden-penguin-young-readers-l3.pdf
    • http://www.gorillawalker.com/brunswick-gardens-charlotte-thomas-pitt-novels.pdf
    • http://www.gorillawalker.com/introduction-to-evidence-based-practice-a-practical-guide-for-nursing.pdf
    • http://www.gorillawalker.com/life-magazine-august-6-1945.pdf
    • http://www.gorillawalker.com/out-classed-women-contemporary-chicana-writers-on-inequitable-gendered-power.pdf
    • http://www.gorillawalker.com/demonic-possession-and-exorcism-in-early-modern-france.pdf
    • http://www.gorillawalker.com/letters-written-during-a-ten-year-s-residence-at-the.pdf
    • http://www.gorillawalker.com/the-meaning-of-the-fourth-of-july-for-the-negro.pdf
    • http://www.gorillawalker.com/voyage-in-the-dark-norton-paperback-fiction.pdf
    • http://www.gorillawalker.com/the-forest-of-time-and-other-stories.pdf
    • http://www.gorillawalker.com/puffins-climb-penguins-rhyme.pdf
    • http://www.gorillawalker.com/sounds-like-home-growing-up-black-and-deaf-in-the.pdf
    • http://www.gorillawalker.com/classical-moxibustion-skills-in-contemporary-clinical-practice.pdf
    • http://www.gorillawalker.com/neutrino-astrophysics.pdf
    • http://www.gorillawalker.com/annie-on-my-mind.pdf
    • http://www.gorillawalker.com/brush-brush-brush-rookie-toddler.pdf
    • http://www.gorillawalker.com/a-comprehensive-approach-to-child-sexual-abuse-investigations.pdf
    • http://www.gorillawalker.com/practical-high-performance-liquid-chromatography-paperback-2010-author-veronika-r.pdf
    • http://www.gorillawalker.com/vandana-chanting-book-mahamevnawa-meditation-monasteries-pali-english.pdf
    • http://www.gorillawalker.com/barron-s-ged-writing-workbook-barron-ged-writing-workbk-2.pdf
    • http://www.gorillawalker.com/the-silver-spike-the-chronicles-of-the-black-company.pdf
    • http://www.gorillawalker.com/memorial-book.pdf
    • http://www.gorillawalker.com/handel-s-messiah-an-oratorio-complete-unabridged-orchestra-and-vocal.pdf
    • http://www.gorillawalker.com/evaluation-of-lightweight-composite-impact-resistant-tail-rotor-drive-shafting.pdf
    • http://www.gorillawalker.com/navy-combat-aircraft-and-pilots-aircraft-enslow.pdf
    • http://www.gorillawalker.com/vegetarian-recipes-top-200-vegetarian-recipes-cookbook-vegetarian-vegetarian-cookbook.pdf
    • http://www.gorillawalker.com/ditka-the-player-the-coach-the-chicago-bears-legend-kindle.pdf
    • http://www.gorillawalker.com/learn-to-play-guitar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.