Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0dc48bf006db5b1…

MALICIOUS

PDF

45.9 KB Created: 2018-11-30 20:30:00 +03:00 Authoring application: Adobe PageMaker 7.0 (via Acrobat Distiller 5.0.5 for Macintosh)
MD5: 09e9f855ff530c0ddbedd245d5ea4894 SHA-1: a1102f37493e428d726e7dd56b9f96d3ad93dd89 SHA-256: a0dc48bf006db5b1b152ebc66ab6a2be45b6e5f4f9c04c2bb7378a0fc6642eaa
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. It contains a large number of embedded URLs pointing to other PDF files on the same domain, indicating a link farm or content distribution strategy. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with 32 external links, suggesting an attempt to manipulate search engine results or distribute content through a network of linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8173

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/steinlen-s-cats.pdf
    • http://www.gorillawalker.com/edinburgh-horrible-histories.pdf
    • http://www.gorillawalker.com/the-adventures-of-tom-sawyer-study-guide-timeless-timeless-classics.pdf
    • http://www.gorillawalker.com/reprint-1962-yearbook-hillcrest-high-school-dallas-texas.pdf
    • http://www.gorillawalker.com/hemispheres-think-write-handwriting-programme.pdf
    • http://www.gorillawalker.com/acoustic-remote-sensing-applications-lecture-notes-in-earth-sciences.pdf
    • http://www.gorillawalker.com/every-night-josephine.pdf
    • http://www.gorillawalker.com/reproducing-jews-a-cultural-account-of-assisted-conception-in-israel.pdf
    • http://www.gorillawalker.com/backyard-one-small-square.pdf
    • http://www.gorillawalker.com/it-was-just-a-house.pdf
    • http://www.gorillawalker.com/ballet-and-opera-in-the-age-of-giselle.pdf
    • http://www.gorillawalker.com/early-reading-an-annotated-bibliography.pdf
    • http://www.gorillawalker.com/mergent-s-handbook-of-common-stocks-summer-2006-featuring-first.pdf
    • http://www.gorillawalker.com/nuremberg-diary.pdf
    • http://www.gorillawalker.com/insight-advanced-test-bank-multirom.pdf
    • http://www.gorillawalker.com/brain-quest-2nd-grade-reading.pdf
    • http://www.gorillawalker.com/seventy-five-years-in-the-madura-mission-a-history-of.pdf
    • http://www.gorillawalker.com/the-story-of-the-philadelphia-eagles-the-nfl-today.pdf
    • http://www.gorillawalker.com/catalogue-of-the-armenian-manuscripts-in-the-cambridge-university-library.pdf
    • http://www.gorillawalker.com/adapting-the-twelve-steps-to-chronic-pain-an-article-from.pdf
    • http://www.gorillawalker.com/carpentry-and-building-construction-carpentry-math.pdf
    • http://www.gorillawalker.com/direkt-karriere-der-einfachste-weg-nach-ganz-oben.pdf
    • http://www.gorillawalker.com/big-ideas-math-a-common-core-curriculum-red.pdf
    • http://www.gorillawalker.com/from-middleton-and-rowley-s-changeling-to-sam-shepard-s.pdf
    • http://www.gorillawalker.com/peru-country-explorers.pdf
    • http://www.gorillawalker.com/luke-new-hope-new-joy-lifeguide-bible-studies.pdf
    • http://www.gorillawalker.com/dicionario-academico-da-l-ngua-portuguesa-portuguese-monolingual-dictionary-portuguese.pdf
    • http://www.gorillawalker.com/medical-terminology-specialties-a-medical-specialties-approach-with-patient-records.pdf
    • http://www.gorillawalker.com/schirmer-s-american-folk-song-series-ballads-love-songs-and.pdf
    • http://www.gorillawalker.com/characters-in-paradise-a-yellowstone-memoir.pdf
    • http://www.gorillawalker.com/snuggle-buddies-disney-princess-palace-pets-step-into-reading.pdf
    • http://www.gorillawalker.com/raw-energy-in-a-glass-126-nutrition-packed-smoothies-green.pdf
    • http://www.gorillawalker.com/the-age-of-discontinuity-guidelines-to-our-changing-society.pdf
    • http://www.gorillawalker.com/llana-of-gathol-and-john-carter-of-mars.pdf
    • http://www.gorillawalker.com/outer-banks-cookbook-recipes-traditions-from-north-carolina-s-barrier.pdf
    • http://www.gorillawalker.com/sonate-per-clavicembalo-volume-4-critical-edition-sonatas-for-harpsichord.pdf
    • http://www.gorillawalker.com/complete-guide-to-body-massage-comprehensive-step-by-step-massage.pdf
    • http://www.gorillawalker.com/sex-addiction-the-partners-perspective-a-comprehensive-guide-to-understanding.pdf
    • http://www.gorillawalker.com/the-age-of-reptiles-unknown-binding.pdf
    • http://www.gorillawalker.com/the-road-to-little-dribbling-more-notes-from-a-small.pdf
    • http://www.gorill
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.