Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa1ab31d786f2b15…

MALICIOUS

PDF

46.0 KB Created: 2018-12-02 10:55:19 +03:00 Authoring application: AH XSL Formatter V6.2 MR5 for Windows (x64) : 6.2.7.18952 (via Antenna House PDF Output Library 6.2.625 (Windows (x64)))
MD5: f415b505365087accd4b29c556cf37aa SHA-1: 68deb31d7bbfe01d0264bcaf4a59a07bec0ed67c SHA-256: aa1ab31d786f2b15f2d5de0ba5b5a55640ea8063df8363ff5d3eb8a738f472ef
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or to distribute a large volume of content, potentially malicious, from a single domain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8173

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/conversions-two-family-stories-from-the-reformation-and-modern-america.pdf
    • http://www.gorillawalker.com/stabilization-and-stagnation-in-the-jamaican-economy-1972-97-some.pdf
    • http://www.gorillawalker.com/little-for-her-special-man-age-play-man-of-the.pdf
    • http://www.gorillawalker.com/aqa-gcse-maths-higher-teacher-companion.pdf
    • http://www.gorillawalker.com/tolkien-calendar-1990.pdf
    • http://www.gorillawalker.com/who-are-we-now-christian-humanism-christian-humanism-and-the.pdf
    • http://www.gorillawalker.com/select-british-documents-of-the-canadian-war-of-1812-in.pdf
    • http://www.gorillawalker.com/field-guide-and-atlas-of-the-seaweed-resources-of-the.pdf
    • http://www.gorillawalker.com/scientific-american-psychology-loose-leaf-launchpad-6-month-access-card.pdf
    • http://www.gorillawalker.com/la-sombra-sobre-el-banco-de-piedra-gran-angular-spanish.pdf
    • http://www.gorillawalker.com/chardonnay.pdf
    • http://www.gorillawalker.com/the-chinese-impact-upon-english-renaissance-literature-a-globalization-and.pdf
    • http://www.gorillawalker.com/physical-metallurgy-principles.pdf
    • http://www.gorillawalker.com/the-2011-import-and-export-market-for-blankets-and-traveling.pdf
    • http://www.gorillawalker.com/virtual-physical-modeling-for-engineering-design.pdf
    • http://www.gorillawalker.com/north-american-new-right-vol-1.pdf
    • http://www.gorillawalker.com/step-by-step-home-facial-care-booklet-10-minutes-for.pdf
    • http://www.gorillawalker.com/structural-reliability.pdf
    • http://www.gorillawalker.com/zocker-wie-man-2000-euro-in-20-tagen-verdient-ohne.pdf
    • http://www.gorillawalker.com/polarimetric-radar-imaging-from-basics-to-applications-optical-science-and.pdf
    • http://www.gorillawalker.com/deathbound-subjectivity-studies-in-phenomenology-and-existential-philosophy.pdf
    • http://www.gorillawalker.com/the-story-of-mathematics-from-creating-the-pyramids-to-exploring.pdf
    • http://www.gorillawalker.com/dk-readers-a-day-in-a-life-of-a-builder.pdf
    • http://www.gorillawalker.com/substance-abuse-dantes-dsst-test-study-guide-pass-your-class.pdf
    • http://www.gorillawalker.com/the-green-marine-an-irishman-s-war-in-iraq.pdf
    • http://www.gorillawalker.com/advanced-video-coding-systems.pdf
    • http://www.gorillawalker.com/basic-cartography-volume-1.pdf
    • http://www.gorillawalker.com/the-presentation-coach-bare-knuckle-brilliance-for-every-presenter.pdf
    • http://www.gorillawalker.com/budgeting-a-comparative-theory-of-budgeting-processes-revised-edition.pdf
    • http://www.gorillawalker.com/mural-art-vol-3-murals-on-huge-public-surfaces-around.pdf
    • http://www.gorillawalker.com/dreaming-with-rousseau-mini-masters.pdf
    • http://www.gorillawalker.com/the-history-of-spiritualism-vol-i-and-vol-ii.pdf
    • http://www.gorillawalker.com/star-product-designers-prototypes-products-and-sketches-from-the-world.pdf
    • http://www.gorillawalker.com/electric-fields-of-the-brain-the-neurophysics-of-eeg-2nd.pdf
    • http://www.gorillawalker.com/dumplin-can-play.pdf
    • http://www.gorillawalker.com/the-word-from-paris-essays-on-modern-french-thinkers-and.pdf
    • http://www.gorillawalker.com/d-and-d-standard-oil-abbreviator.pdf
    • http://www.gorillawalker.com/official-rules-of-the-nfl-2000-2001.pdf
    • http://www.gorillawalker.com/data-visualization-with-flash-builder-designing-ria-and-air-applications.pdf
    • http://www.gorillawalker.com/government-and-the-economics-of-sport-longman-ilam-leisure-management.pdf
    • http://www.gorillawalker.com/who-are-we-no
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.