Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa4eabf39f95a17b…

MALICIOUS

PDF

41.9 KB Created: 2019-02-13 19:54:26 +03:00 Authoring application: Adobe InDesign CS3 (5.0.3) (via Adobe PDF Library 8.0)
MD5: 427a12c332fc7f155d3ac9df943e734b SHA-1: b256145f536b26f3521086bc6c84d1e597137f00 SHA-256: aa4eabf39f95a17b534a0f77ef7059188f645b9c6269527af24f6e629616fbd5
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. While no scripts were extracted, the sheer volume of links suggests a malicious intent, possibly for SEO manipulation or to distribute further malicious content. The embedded URLs are the primary IOCs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/using-feedback-in-organizational-consulting-division-13-fundamentals-of-consulting.pdf
    • http://www.gorillawalker.com/the-arab-americans-major-american-immigration.pdf
    • http://www.gorillawalker.com/athletics-conditioning.pdf
    • http://www.gorillawalker.com/the-easter-offensive-vietnam-1972-volume-2-tanks-in-the.pdf
    • http://www.gorillawalker.com/the-trail-to-seven-pines.pdf
    • http://www.gorillawalker.com/citroen-c3-service-and-repair-manual.pdf
    • http://www.gorillawalker.com/perry-rhodan-neo-93-weltensaat-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/behind-the-plough-the-agricultural-society-of-nineteenth-century-hertfordshire.pdf
    • http://www.gorillawalker.com/il-misogallo-e-gli-epigrammi-italian-edition.pdf
    • http://www.gorillawalker.com/drama-clip-art-production-forms-lillenas-drama-topics-series.pdf
    • http://www.gorillawalker.com/presuppositions-of-india-s-philosophies.pdf
    • http://www.gorillawalker.com/symphony-no3-liturgique-study-score-edition-eulenburg.pdf
    • http://www.gorillawalker.com/what-s-the-soup.pdf
    • http://www.gorillawalker.com/elsevier-s-nautical-dictionary-vol-3-marine-engineering.pdf
    • http://www.gorillawalker.com/carl-furillo-brooklyn-dodgers-all-star.pdf
    • http://www.gorillawalker.com/interracial-gender-swap-bwwm-feminization-interracial-best-friend-erotica.pdf
    • http://www.gorillawalker.com/the-romance-of-the-three-kingdoms-vols-1-and-2.pdf
    • http://www.gorillawalker.com/animals-disease-and-human-society-human-animal-relations-and-the.pdf
    • http://www.gorillawalker.com/use-of-oblique-aerial-photography-to-develop-an-inventory-of.pdf
    • http://www.gorillawalker.com/the-spirit-of-capitalism-nationalism-and-economic-growth.pdf
    • http://www.gorillawalker.com/the-consumer-s-guide-to-safe-anxiety-free-dental-surgery.pdf
    • http://www.gorillawalker.com/by-d-s-malik-java-programming-from-problem-analysis-to.pdf
    • http://www.gorillawalker.com/the-far-side-gallery.pdf
    • http://www.gorillawalker.com/top-10-venice-dk-eyewitness-top-10-travel-guide.pdf
    • http://www.gorillawalker.com/muck-travel-guide-book-of-switzerland-austria-1990-isbn-4876381429.pdf
    • http://www.gorillawalker.com/citadel-miniatures-catalogue-section-two.pdf
    • http://www.gorillawalker.com/michelin-rome.pdf
    • http://www.gorillawalker.com/applied-thermodynamics-for-meteorologists.pdf
    • http://www.gorillawalker.com/five-hundred-years-of-chinese-poetry-1150-1650-the-chin.pdf
    • http://www.gorillawalker.com/attack-of-the-fluffy-bunnies.pdf
    • http://www.gorillawalker.com/the-bells-op-35-vocal-score-russian-edition.pdf
    • http://www.gorillawalker.com/lost-indian-gold-kindle-edition.pdf
    • http://www.gorillawalker.com/sammael-s-wings.pdf
    • http://www.gorillawalker.com/scoop-s-in-charge-super-coloring-book.pdf
    • http://www.gorillawalker.com/delicious-food-for-a-healthy-heart-delicious-recipes-for-life.pdf
    • http://www.gorillawalker.com/the-return-of-the-cavaliers-biography-of-fethullah-gulen.pdf
    • http://www.gorillawalker.com/dreamer-s-pool-a-blackthorn-grim-novel-kindle-edition.pdf
    • http://www.gorillawalker.com/rethinking-acrylic-radical-solutions-for-exploiting-the-world-s-most.pdf
    • http://www.gorillawalker.com/ender-s-game-command-school.pdf
    • http://www.gorillawalker.com/black-rage-in-new-orleans-police-brutality-and-african-american.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.