Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e55e23071710f3d…

MALICIOUS

PDF

43.5 KB Created: 2019-03-18 01:31:54 +03:00 Authoring application: iBooks Author (via Mac OS X 10.9.3 Quartz PDFContext)
MD5: ba595fe9475b747cf51a548d04198e54 SHA-1: 973bd28a5809fb8356f4cebf27fc6b0c32573fcb SHA-256: 9e55e23071710f3d2b5f70c35f062cb6ad2e5acb3987a1c4a2bb78d2767e7c46
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a significant number of external links, indicating a potential SEO manipulation or content distribution scheme. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a link farm or a method to distribute further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/still-feelin-fine-southern-gospel-music-cd.pdf
    • http://www.gorillawalker.com/christian-unity-an-ecumenical-second-spring.pdf
    • http://www.gorillawalker.com/gramsci-is-dead-anarchist-currents-in-the-newest-social-movements.pdf
    • http://www.gorillawalker.com/practical-carriage-wagon-painting.pdf
    • http://www.gorillawalker.com/exploratory-factor-analysis-understanding-statistics.pdf
    • http://www.gorillawalker.com/spanish-education-in-morocco-1912-1956-cultural-interactions-in-a.pdf
    • http://www.gorillawalker.com/the-netherlands-world-traveler.pdf
    • http://www.gorillawalker.com/torbay-torquay-paignton-and-newton-abbot-local-red-book.pdf
    • http://www.gorillawalker.com/ozette-s-heartstone-tales-from-farlandia-volume-2.pdf
    • http://www.gorillawalker.com/darkest-to-dawn-truth-is-my-compass-and-wisdom-my.pdf
    • http://www.gorillawalker.com/northern-minnesota-grand-rapids-bemidji-area-fishing-map-guide-fishing.pdf
    • http://www.gorillawalker.com/aztec-warriors-fierce-fighters.pdf
    • http://www.gorillawalker.com/west-s-paralegal-today-web-tutor-on-blackboard-passcode-for.pdf
    • http://www.gorillawalker.com/a-history-of-russia-volume-1-to-1917-anthem-series.pdf
    • http://www.gorillawalker.com/adobe-fireworks-cs3-user-guide.pdf
    • http://www.gorillawalker.com/fast-fourier-transforms-second-edition-studies-in-advanced-mathematics.pdf
    • http://www.gorillawalker.com/modern-rhythmic-notation.pdf
    • http://www.gorillawalker.com/the-journal-of-an-expedition-across-venezuela-and-colombia-1906.pdf
    • http://www.gorillawalker.com/purity-of-heart-and-contemplation-a-monastic-dialogue-between-christian.pdf
    • http://www.gorillawalker.com/the-cultured-cocktail-150-classic-drinks-from-the-jazz-age.pdf
    • http://www.gorillawalker.com/il-maestro-di-nodi.pdf
    • http://www.gorillawalker.com/judges-quinta-editione-biblia-hebraica-quinta.pdf
    • http://www.gorillawalker.com/official-toefl-ibt-tests-volume-1-2nd-edition.pdf
    • http://www.gorillawalker.com/early-age-thermal-crack-control-in-concrete-ciria-publication.pdf
    • http://www.gorillawalker.com/in-search-of-prosperity.pdf
    • http://www.gorillawalker.com/secrets-of-pompeii-buried-city-of-ancient-rome-archaeological-mysteries.pdf
    • http://www.gorillawalker.com/sacred-solos-for-the-flute-volume-2.pdf
    • http://www.gorillawalker.com/knights-of-the-zodiac-saint-seiya-vol-24.pdf
    • http://www.gorillawalker.com/lord-beaconsfield-and-sir-john-a-macdonald-a-political-and.pdf
    • http://www.gorillawalker.com/carmen-vocal-score-author-georges-bizet-published-on-may-2006.pdf
    • http://www.gorillawalker.com/the-escapes-ground-fighting-book-2.pdf
    • http://www.gorillawalker.com/centre-and-periphery-spatial-variation-in-politics.pdf
    • http://www.gorillawalker.com/imap-amsterdam-with-compass.pdf
    • http://www.gorillawalker.com/milton-s-paradise-lost-christian-guides-to-the-classics.pdf
    • http://www.gorillawalker.com/bed-breakfast-without-the-breakfast.pdf
    • http://www.gorillawalker.com/family-romances-george-sand-s-early-novels.pdf
    • http://www.gorillawalker.com/a-field-guide-to-automotive-technology.pdf
    • http://www.gorillawalker.com/umts-adaptive-antennas-systems-proposal-development-of-adaptive-basestation-antenna.pdf
    • http://www.gorillawalker.com/aikido-exercises-for-teaching-and-training-revised-edition.pdf
    • http://www.gorillawalker.com/doctor-to-the-north-thirty-years-treating-heart-disease-among.pdf
    • http://www.gorillawalker.com/darkest-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.