Malicious PDF — malware analysis report

Static analysis result for SHA-256 999d01988ab38245…

MALICIOUS

PDF

48.2 KB Created: 2018-11-26 21:55:49 +03:00 Authoring application: FrameMaker 7.2 (via Acrobat Distiller 7.0 (Windows))
MD5: a2cabeb9e6c4c71a4116050f0b728e92 SHA-1: 0a216854ac7508dad417faeba51502a2f8b5c332 SHA-256: 999d01988ab38245ccb3dd43e7635453aee0e4413847b6024d93ba1fb996f548
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by a machine learning classifier and contains a heuristic firing for a 'PDF_SEO_LINK_FARM'. This indicates the document's primary purpose is to host a large number of external links, likely leading to malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8527

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/cafe-con-leche-race-class-and-national-image-in-venezuela.pdf
    • http://www.gorillawalker.com/alternating-consciousness-from-perception-to-infinities-and-back-to-free.pdf
    • http://www.gorillawalker.com/after-all-these-years-jack-harris-on-cover-sheet-music.pdf
    • http://www.gorillawalker.com/probable-sons-golden-inheritance-series-2.pdf
    • http://www.gorillawalker.com/the-life-of-meaning-reflections-on-faith-doubt-and-repairing.pdf
    • http://www.gorillawalker.com/guitar-basics-repertoire-guitar-tab.pdf
    • http://www.gorillawalker.com/the-10-day-skin-brushing-detox-the-easy-natural-plan.pdf
    • http://www.gorillawalker.com/diagnostic-manual-intellectual-disability-dm-id-a-textbook-of-diagnosis.pdf
    • http://www.gorillawalker.com/journal-of-james-kenny-1761-1763-pennsylvania-magazine-of-history.pdf
    • http://www.gorillawalker.com/the-beginners-guide-to-saving-and-investing-for-canadians.pdf
    • http://www.gorillawalker.com/do-you-really-want-to-meet-a-lion.pdf
    • http://www.gorillawalker.com/pray-like-a-wife-31-days-of-praying-for-your.pdf
    • http://www.gorillawalker.com/maldives-guide-to-the-country-paperback.pdf
    • http://www.gorillawalker.com/thomas-the-turtle-s-adventures.pdf
    • http://www.gorillawalker.com/entropia-a-collection-of-unusually-rare-stamps.pdf
    • http://www.gorillawalker.com/citizen-student-soldier-latina-o-youth-jrotc-and-the-american.pdf
    • http://www.gorillawalker.com/simplement-voir-aux-confins-de-la-po-sie-contemporaine-et.pdf
    • http://www.gorillawalker.com/deliver-us-from-evil-peacekeepers-warlords-and-a-world-of.pdf
    • http://www.gorillawalker.com/korean-enterprise-the-quest-for-globalization-management-of-innovation-and.pdf
    • http://www.gorillawalker.com/the-party-is-over-how-republicans-went-crazy-democrats-became.pdf
    • http://www.gorillawalker.com/quseir-al-qadim-1980-preliminary-report-american-research-center-in.pdf
    • http://www.gorillawalker.com/a-case-of-first-impression.pdf
    • http://www.gorillawalker.com/four-classic-sci-fi-stories-by-john-w-campbell.pdf
    • http://www.gorillawalker.com/housing-decisions-in-later-life.pdf
    • http://www.gorillawalker.com/etudes-op-48.pdf
    • http://www.gorillawalker.com/koltanowski-phoenix-attack-the-future-of-the-c3-colle-putting.pdf
    • http://www.gorillawalker.com/lucy-and-tom-s-christmas.pdf
    • http://www.gorillawalker.com/the-slumbering-volcano-american-slave-ship-revolts-and-the-production.pdf
    • http://www.gorillawalker.com/tarthian-empire-companion-an-illustrated-world-building-bible-and-guide.pdf
    • http://www.gorillawalker.com/the-canadian-brass-15-favorite-hymns-keyboard-accompaniment-easy-arrangements.pdf
    • http://www.gorillawalker.com/applebaum-samuel-chamber-music-for-2-string-instruments-book-2.pdf
    • http://www.gorillawalker.com/coping-successfully-with-hiatus-hernia-new-edition.pdf
    • http://www.gorillawalker.com/bad-for-you-sea-breeze-book-7-kindle-edition.pdf
    • http://www.gorillawalker.com/have-a-grill-you-should-be-grilling-pizza-let-s.pdf
    • http://www.gorillawalker.com/aztec-inca-and-maya-technology-in-times-past.pdf
    • http://www.gorillawalker.com/maturing-megacities-the-pearl-river-delta-in-progressive-transformation-advances.pdf
    • http://www.gorillawalker.com/computational-geometry-algorithms-and-applications-second-edition.pdf
    • http://www.gorillawalker.com/project-management-accounting-budgeting-tracking-and-reporting-costs-and-profitability.pdf
    • http://www.gorillawalker.com/imperialism-and-dependency-obstacles-to-african-development.pdf
    • http://www.gorillawalker.com/berlitz-dublin-pocket-guide-in-french-berlitz-pocket-guides.pdf
    • http://www.gorillawalker.com/alternati
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.