Malicious PDF — malware analysis report

Static analysis result for SHA-256 9aa76390a89be9a5…

MALICIOUS

PDF

40.9 KB Created: 2018-12-14 20:02:36 +03:00 Authoring application: Acrobat PDFMaker 11 for Word (via Adobe PDF Library 11.0) First seen: 2019-01-12
MD5: f4bc900f6bd58ab2445aaa026517b79f SHA-1: f102d82f817503f0b2c0820d771993e44b122d17 SHA-256: 9aa76390a89be9a5cf7f5a069cc815fd091612ef52ded44bfaad839298d23276
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains multiple embedded URLs, one of which is flagged as suspicious by a heuristic. The ML classifier also identified the PDF as malicious. The primary suspicious URL points to a PDF file, suggesting a lure to download further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/alex-in-wonderland-an-erotic-parody.pdf In PDF document text
    • http://www.gorillawalker.com/sandra-smiths-review-for-nclex-rn.pdfIn PDF document text
    • http://www.gorillawalker.com/enough-inigo-enough-the-gentle-revolution-series.pdfIn PDF document text
    • http://www.gorillawalker.com/cajun-and-creole-food-practices-customs-and-holidays-ethnic-and.pdfIn PDF document text
    • http://www.gorillawalker.com/elementary-spanish-chatbook.pdfIn PDF document text
    • http://www.gorillawalker.com/land-law-concentrate-law-revision-and-study-guide.pdfIn PDF document text
    • http://www.gorillawalker.com/european-union-law-in-a-nutshell-8th.pdfIn PDF document text
    • http://www.gorillawalker.com/component-reliability-under-creep-fatigue-conditions-cism-international-centre-for.pdfIn PDF document text
    • http://www.gorillawalker.com/manhood-how-to-be-a-better-man-or-just-live.pdfIn PDF document text
    • http://www.gorillawalker.com/big-bang-the-origin-of-the-universe-p-s.pdfIn PDF document text
    • http://www.gorillawalker.com/tallinn-2nd-footprint-pocket-guides.pdfIn PDF document text
    • http://www.gorillawalker.com/rory-the-little-dragon-lizard.pdfIn PDF document text
    • http://www.gorillawalker.com/the-naked-lawyer.pdfIn PDF document text
    • http://www.gorillawalker.com/very-first-words-at-home.pdfIn PDF document text
    • http://www.gorillawalker.com/girlvert-a-porno-memoir.pdfIn PDF document text
    • http://www.gorillawalker.com/the-best-gospel-songs-ever.pdfIn PDF document text
    • http://www.gorillawalker.com/eisenberg-and-cox-s-corporations-and-other-business-organizations-cases.pdfIn PDF document text
    • http://www.gorillawalker.com/the-military-file-a-boner-book.pdfIn PDF document text
    • http://www.gorillawalker.com/ritual-and-pastoral-care-theology-and-pastoral-care-theology-pastoral.pdfIn PDF document text
    • http://www.gorillawalker.com/the-food-truck-handbook-start-grow-and-succeed-in-the.pdfIn PDF document text
    • http://www.gorillawalker.com/animal-crackers-joke-file-funfax.pdfIn PDF document text
    • http://www.gorillawalker.com/understanding-today-s-natural-gas-business.pdfIn PDF document text
    • http://www.gorillawalker.com/ged-practice-test-2-0-scoring-stencil.pdfIn PDF document text
    • http://www.gorillawalker.com/tales-from-the-den-wild-and-weird-stories-for-bears.pdfIn PDF document text
    • http://www.gorillawalker.com/cecilia-valdes-spanish-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/catamarca-province-road-map-argentina.pdfIn PDF document text
    • http://www.gorillawalker.com/canadian-community-as-partner-theory-and-multidisciplinary-practice-paperback-common.pdfIn PDF document text
    • http://www.gorillawalker.com/jazz-from-a-to-z-a-graphic-dictionary.pdfIn PDF document text
    • http://www.gorillawalker.com/big-book-of-pocket-knives.pdfIn PDF document text
    • http://www.gorillawalker.com/bluetooth-low-energy-the-developer-s-handbook.pdfIn PDF document text
    • http://www.gorillawalker.com/cooking-in-the-photographer-146-s-house.pdfIn PDF document text
    • http://www.gorillawalker.com/us-army-technical-manual-tm-5-1080-250-12-p.pdfIn PDF document text
    • http://www.gorillawalker.com/ireland-s-wild-plants-myths-legends-folklore.pdfIn PDF document text
    • http://www.gorillawalker.com/diccionario-collins-espa-ol-ingl-s-ingl-s-espa-ol.pdfIn PDF document text
    • http://www.gorillawalker.com/love-at-the-heart-of-things.pdfIn PDF document text
    • http://www.gorillawalker.com/the-secret-history-of-the-world-as-laid-down-by.pdfIn PDF document text
    • http://www.gorillawalker.com/mathematics-applications-and-concepts-course-3-chapter-9-resource-masters.pdfIn PDF document text
    • http://www.gorillawalker.com/texts-from-mittens-a-cat-who-has-an-unlimited-data.pdfIn PDF document text
    • http://www.gorillawalker.com/bukhara-caught-in-time.pdfIn PDF document text
    • http://www.gorillawalker.com/the-companion-to-raymond-aron-recovering-political-philosophy.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000d94.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD94 16648 bytes
SHA-256: dc20c2b181b7c3b205a8f3041a9f69ccc495ea0d5632b9b5bdd82973dd48ca8f

Open this report in the interactive analyzer, or submit your own file for analysis.