Malicious PDF — malware analysis report

Static analysis result for SHA-256 a25a5662ba651293…

MALICIOUS

PDF

43.1 KB Created: 2018-11-23 21:03:35 +03:00 Authoring application: Adobe InDesign CS2_J (4.0.5) (via Adobe PDF Library 7.0)
MD5: 916911190cfd0505c1fea85d15ec173d SHA-1: 6df341bb9721232523d1e76e46ade4be0da91ce6 SHA-256: a25a5662ba65129347bcee821e5e8dced4a82814b2c8c65098d70a2a7119a7df
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. A critical heuristic identified a large number of external links within the document, suggesting a link farm or redirection to malicious sites. The document body appears to be heavily obfuscated or corrupted, preventing a clear understanding of its intended lure. The primary attack pattern involves leveraging these embedded links to direct users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/train-the-trainer-workshop-coursebook-3rd-edition-w-cd.pdf
    • http://www.gorillawalker.com/cuentos-desde-las-sombras-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/cygnes-flute-et-harpe-ou-piano-composed-by-henri-busser.pdf
    • http://www.gorillawalker.com/what-is-life-worth-the-inside-story-of-the-9.pdf
    • http://www.gorillawalker.com/chaos-catastrophe-and-human-affairs-applications-of-nonlinear-dynamics-to.pdf
    • http://www.gorillawalker.com/waterfalls-of-the-mid-atlantic-states-200-falls-in-maryland.pdf
    • http://www.gorillawalker.com/managing-the-end-to-bridge-the-beginning-practical-tips-and.pdf
    • http://www.gorillawalker.com/a-compilation-of-available-literature-on-the-larvae-of-fishes.pdf
    • http://www.gorillawalker.com/den-schickt-er-in-die-weite-welt-in-den-himalaya.pdf
    • http://www.gorillawalker.com/ossian-and-national-epic-passagem-english-and-english-edition.pdf
    • http://www.gorillawalker.com/fracture-mechanics-of-piezoelectric-and-ferroelectric-solids.pdf
    • http://www.gorillawalker.com/understanding-irritable-bowel-syndrome-family-doctor-books.pdf
    • http://www.gorillawalker.com/atomic-and-laser-spectroscopy-oxford-classic-texts-in-the-physical.pdf
    • http://www.gorillawalker.com/the-universal-path-of-natural-life-course-for-total-health.pdf
    • http://www.gorillawalker.com/balinovic-v-evening-star-newspaper-co-u-s-supreme-court.pdf
    • http://www.gorillawalker.com/rescue-at-the-top-of-the-world-the-true-story.pdf
    • http://www.gorillawalker.com/ios-8-sdk-development-creating-iphone-and-ipad-apps-with.pdf
    • http://www.gorillawalker.com/el-lado-activo-del-infinito-spanish-edition.pdf
    • http://www.gorillawalker.com/the-vanishing-chip.pdf
    • http://www.gorillawalker.com/nigeria-enchantment-of-the-world-second.pdf
    • http://www.gorillawalker.com/intimate.pdf
    • http://www.gorillawalker.com/dinamika-i-seismostoikost-sooruzhenii-russian-edition.pdf
    • http://www.gorillawalker.com/immunopathology-of-tropical-diseases.pdf
    • http://www.gorillawalker.com/counseling-african-american-marriages-and-families-counseling-and-pastoral-theology.pdf
    • http://www.gorillawalker.com/mothering-the-new-mother-your-postpartum-resource-companion.pdf
    • http://www.gorillawalker.com/the-greatest-exploration-stories-ever-told-true-tales-of-search.pdf
    • http://www.gorillawalker.com/managerial-accounting-bywhitecotton.pdf
    • http://www.gorillawalker.com/foundations-of-dharmakirti-s-philosophy.pdf
    • http://www.gorillawalker.com/kid-fitness.pdf
    • http://www.gorillawalker.com/high-performance-government-structure-leadership-incentives.pdf
    • http://www.gorillawalker.com/the-black-border-kindle-edition.pdf
    • http://www.gorillawalker.com/owasp-top-10-the-top-10-most-critical-web-application.pdf
    • http://www.gorillawalker.com/mates-dates-and-sizzling-summers.pdf
    • http://www.gorillawalker.com/practical-cost-control-handbook-for-project-managers.pdf
    • http://www.gorillawalker.com/spirit-hovering.pdf
    • http://www.gorillawalker.com/lost-traveller.pdf
    • http://www.gorillawalker.com/consumer-behavior-and-managerial-decision-making-2nd-second-edition.pdf
    • http://www.gorillawalker.com/cotton-reloaded-34-auge-um-auge-german-edition.pdf
    • http://www.gorillawalker.com/annexation-of-dominica-speech-of-hon-oliver-p-morton-of.pdf
    • http://www.gorillawalker.com/suckled-by-the-viking-kindle-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.