Malicious PDF — malware analysis report

Static analysis result for SHA-256 a020f1854775d838…

MALICIOUS

PDF

43.7 KB Created: 2019-03-16 13:53:11 +03:00 Authoring application: PrimoPDF http://www.primopdf.com (via Nitro PDF PrimoPDF)
MD5: a8a11bec91535ae455b047ab72a34772 SHA-1: d6cfb3b54aa1220c5d1109bd5006b1e8ba53d141 SHA-256: a020f1854775d838d450d71ee327eb614d33339cdef95da3458ee2a3fc406810
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links pointing to the same domain, indicating a link farm or SEO manipulation tactic. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the sheer volume of links suggests a malicious intent to redirect users to potentially harmful content or to manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/captain-cook-s-journal-first-voyage-round-the-world-forgotten.pdf
    • http://www.gorillawalker.com/keeping-safe-slim-goodbody-good-health-guides.pdf
    • http://www.gorillawalker.com/choose-peace-happiness-a-52-week-guide.pdf
    • http://www.gorillawalker.com/el-nuevo-testamento-de-nuestro-se-or-y-salvador-jesucristo.pdf
    • http://www.gorillawalker.com/harlem-crossroads-black-writers-and-the-photograph-in-the-twentieth.pdf
    • http://www.gorillawalker.com/authentic-mexican-101-delicious-authentic-mexican-recipes.pdf
    • http://www.gorillawalker.com/paper-and-paper-products-in-malaysia-download-pdf-digital.pdf
    • http://www.gorillawalker.com/on-the-verge-of-a-planetary-civilization-a-philosophy-of.pdf
    • http://www.gorillawalker.com/the-reptile-club-librarian.pdf
    • http://www.gorillawalker.com/ravaging-the-bride.pdf
    • http://www.gorillawalker.com/microwave-handbook-components-and-operating-techniques-v-1.pdf
    • http://www.gorillawalker.com/power-in-prayer-31-teachings-to-strengthen-our-connection-with.pdf
    • http://www.gorillawalker.com/interpersonal-skills-at-work.pdf
    • http://www.gorillawalker.com/his-pleasure-alpha-male-group-bdsm-billionaire-uniform-bbw-interracial.pdf
    • http://www.gorillawalker.com/teenage-wasteland-suburbia-s-dead-end-kids.pdf
    • http://www.gorillawalker.com/silver-strike-the-true-story-of-silver-mining-in-the.pdf
    • http://www.gorillawalker.com/tourism-a-gender-analysis.pdf
    • http://www.gorillawalker.com/american-idioms-handbook-for-everyday-use-american-idioms-and-phrases.pdf
    • http://www.gorillawalker.com/plays-by-susan-glaspell.pdf
    • http://www.gorillawalker.com/vpns-a-beginner-s-guide.pdf
    • http://www.gorillawalker.com/song-ren-shi-hua-wai-bian-mandarin-chinese-edition.pdf
    • http://www.gorillawalker.com/a-place-among-the-stars-the-women-of-star-trek.pdf
    • http://www.gorillawalker.com/divertimento-con-i-vicini-italian-edition.pdf
    • http://www.gorillawalker.com/splashes-of-joy-in-the-cesspools-of-life-pain-is.pdf
    • http://www.gorillawalker.com/hr-for-small-business-2e-an-essential-guide-for-managers.pdf
    • http://www.gorillawalker.com/correspondence-relating-to-the-war-with-spain-and-conditions-growing.pdf
    • http://www.gorillawalker.com/hypnotherapy-foundation-course.pdf
    • http://www.gorillawalker.com/adobe-s-designs-on-web-analytics-the-omniture-acquisition-kindle.pdf
    • http://www.gorillawalker.com/free-to-care-recovery-for-the-whole-family.pdf
    • http://www.gorillawalker.com/arkiv-f-r-botanik-volume-v-17-1922-swedish-edition.pdf
    • http://www.gorillawalker.com/the-winds-of-marble-arch.pdf
    • http://www.gorillawalker.com/motocross-cycles-cruisin-capstone.pdf
    • http://www.gorillawalker.com/costumes-of-mexico.pdf
    • http://www.gorillawalker.com/the-girl-s-guide-to-camping-outdoor-living-in-serious.pdf
    • http://www.gorillawalker.com/delta-green-alien-intelligence.pdf
    • http://www.gorillawalker.com/plessy-v-ferguson-civil-rights-movement.pdf
    • http://www.gorillawalker.com/no-5-volume-1-viz-graphic-novels-vol-1.pdf
    • http://www.gorillawalker.com/corrective-exercise-solutions-to-common-shoulder-and-hip-dysfunction.pdf
    • http://www.gorillawalker.com/triumphs-of-the-imagination.pdf
    • http://www.gorillawalker.com/status-change-of-languages-natural-language-processing.pdf
    • http://www.primopdf.com
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.