Malicious PDF — malware analysis report

Static analysis result for SHA-256 9eeb0c6f55335a5b…

MALICIOUS

PDF

45.1 KB Created: 2019-05-05 01:33:32 +03:00 Authoring application: Acrobat PDFMaker 11 for Word (via Adobe PDF Library 11.0)
MD5: 3242301ff89dde38c8d8c9cd4f2e1099 SHA-1: 4abc53d2c9e1c4739de0e9a9fbbcbe635a66562e SHA-256: 9eeb0c6f55335a5bb2846ab3b3b3cf40227427028b0617c4a81649b524981aaf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a link farm or a method to distribute content through numerous indirect links. The ML classifier also flagged the document as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/technical-editing-with-new-mytechcommlab-without-pearson-etext-access-card.pdf
    • http://www.gorillawalker.com/modern-families-stories-of-extraordinary-journeys-to-kinship.pdf
    • http://www.gorillawalker.com/koneko-cat-2016-weekly-planner-calendar.pdf
    • http://www.gorillawalker.com/voice-of-an-angel-my-life-so-far.pdf
    • http://www.gorillawalker.com/my-name-is-legion-the-story-and-soul-of-the.pdf
    • http://www.gorillawalker.com/labview-tm-7-0-express-student-edition-with-7-1.pdf
    • http://www.gorillawalker.com/miracles-what-they-are-why-they-happen-and-how-they.pdf
    • http://www.gorillawalker.com/home-ayurveda-spa.pdf
    • http://www.gorillawalker.com/not-quite-white-white-trash-and-the-boundaries-of-whiteness.pdf
    • http://www.gorillawalker.com/3-minute-horsemanship-60-amazingly-achievable-lessons-to-improve-your.pdf
    • http://www.gorillawalker.com/paleo-recipes-for-the-big-game-or-any-given-sunday.pdf
    • http://www.gorillawalker.com/bungalow-american-restoration-style.pdf
    • http://www.gorillawalker.com/la-compania-de-maria-iconografia-celebre-de-mexico-spanish-edition.pdf
    • http://www.gorillawalker.com/the-future-of-biblical-interpretation-responsible-plurality-in-biblical-hermeneutics.pdf
    • http://www.gorillawalker.com/the-everygirl-s-guide-to-diet-and-fitness-how-i.pdf
    • http://www.gorillawalker.com/quitting-previously-published-as-mastering-the-art-of-quitting-why.pdf
    • http://www.gorillawalker.com/brazilian-adventure.pdf
    • http://www.gorillawalker.com/current-perceptions-of-the-role-of-dental-hygienists-in-interdisciplinary.pdf
    • http://www.gorillawalker.com/the-arrl-handbook-for-radio-amateurs-2001-arrl-handbook-for.pdf
    • http://www.gorillawalker.com/evaluating-contract-claims.pdf
    • http://www.gorillawalker.com/john-g-lake-his-life-his-sermons-his-boldness-of.pdf
    • http://www.gorillawalker.com/government-zero-no-borders-no-language-no-culture.pdf
    • http://www.gorillawalker.com/concerto-in-d-major-for-flute-oboe-violin-bassoon-strings.pdf
    • http://www.gorillawalker.com/storm-the-hottest-guy-in-hollywood-a-bdsm-erotic-romance.pdf
    • http://www.gorillawalker.com/radiography-technology-environment-professionalism.pdf
    • http://www.gorillawalker.com/la-seduzione-del-male-elementi-di-criminologia-applicata-italian-edition.pdf
    • http://www.gorillawalker.com/young-explorers-in-the-land-where-jesus-lived.pdf
    • http://www.gorillawalker.com/concerto-for-oboe-reduction-for-oboe-and-piano.pdf
    • http://www.gorillawalker.com/prophecy-and-society-in-ancient-israel.pdf
    • http://www.gorillawalker.com/linear-and-non-linear-numerical-analysis-of-foundations.pdf
    • http://www.gorillawalker.com/musician-s-business-and-legal-guide-the-3rd-edition-musician.pdf
    • http://www.gorillawalker.com/the-kentucky-cycle.pdf
    • http://www.gorillawalker.com/modeling-biological-systems-principles-and-applications.pdf
    • http://www.gorillawalker.com/music-in-the-service-of-the-king-france-in-the.pdf
    • http://www.gorillawalker.com/the-spiral-notebook-the-aurora-theater-shooter-and-the-epidemic.pdf
    • http://www.gorillawalker.com/duo-for-oboe-and-bassoon.pdf
    • http://www.gorillawalker.com/principles-and-practice-of-sports-management.pdf
    • http://www.gorillawalker.com/teaching-english-grammar.pdf
    • http://www.gorillawalker.com/worlds-of-cthulhu.pdf
    • http://www.gorillawalker.com/manantiales-en-el-desierto-biblia-nvi-365-devocionales-para-satisfacer.pdf
    • http://www.gorillawalker.com/my-name-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.