Malicious PDF — malware analysis report

Static analysis result for SHA-256 aaef8b4668d8658f…

MALICIOUS

PDF

34.4 KB Created: 2020-02-08 18:31:37 +03:00 Authoring application: Writer (via OpenOffice.org 2.0.3)
MD5: 789e63a680c4fdf9153fa0f9fef2a4db SHA-1: 9be7a007f5054c6790d3dc0f9f6456521e85efc9 SHA-256: aaef8b4668d8658f988ea708658904518984beecdaf6778536e106a499f69a42
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The sample is a PDF document that contains numerous embedded URLs, all pointing to the same domain. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' indicates that the document's content is designed to trick users into believing they are receiving a prize or parcel, which is a common advance-fee fraud tactic. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves luring the user to download a malicious PDF from the provided URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8018

Heuristics 3

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/sedimentation-engineering-manuals-and-reports-on-engineering-practice-no-54.pdf
    • http://www.gorillawalker.com/welsh-phrases-for-learners.pdf
    • http://www.gorillawalker.com/fta-new-york-mass-transit-grants-false-statements-to-fta.pdf
    • http://www.gorillawalker.com/diy-dentistry-and-other-alarming-inventions.pdf
    • http://www.gorillawalker.com/should-music-lyrics-be-censored-for-violence-and-exploitation-at.pdf
    • http://www.gorillawalker.com/the-captives-or-escape-from-the-druid-council.pdf
    • http://www.gorillawalker.com/song-of-blades-and-heroes-revised-edition.pdf
    • http://www.gorillawalker.com/the-life-and-times-of-scrooge-mcduck.pdf
    • http://www.gorillawalker.com/carolina-hurricanes-nhl-2013-14-2-year-planner.pdf
    • http://www.gorillawalker.com/the-autocad-lt-97-tutor-for-engineering-graphics.pdf
    • http://www.gorillawalker.com/osteoporosis-questions-and-answers.pdf
    • http://www.gorillawalker.com/li-ka-shing-hong-kong-s-elusive-billionaire.pdf
    • http://www.gorillawalker.com/the-marriage-you-ve-always-wanted-event-experience-participant-guide.pdf
    • http://www.gorillawalker.com/the-150-healthiest-slow-cooker-recipes-on-earth-the-surprising.pdf
    • http://www.gorillawalker.com/tcp-ip-implementation-in-an-os-2-warp-environment.pdf
    • http://www.gorillawalker.com/introduction-to-matrices-and-linear-transformations.pdf
    • http://www.gorillawalker.com/metes-and-bounds-descriptions.pdf
    • http://www.gorillawalker.com/the-ukraine-a-history.pdf
    • http://www.gorillawalker.com/star-wars-the-clone-wars-character-encyclopedia.pdf
    • http://www.gorillawalker.com/lectures-on-the-church-and-the-sacraments-kindle-edition.pdf
    • http://www.gorillawalker.com/blueprint-4-capturing-global-environmental-value-blueprint-series-vol-4.pdf
    • http://www.gorillawalker.com/ophthalmic-dictionary-and-vocabulary-builder-for-eye-care-professionals.pdf
    • http://www.gorillawalker.com/armor-bearer-training-series-in-the-spirit-of-leadership.pdf
    • http://www.gorillawalker.com/using-mis-plus-mymislab-with-pearson-etext-access-card-package.pdf
    • http://www.gorillawalker.com/sumatra-medan-travel-map-fifth-edition-periplus-travel-maps.pdf
    • http://www.gorillawalker.com/s-hrg-112-217-providing-legal-services-by-members-of.pdf
    • http://www.gorillawalker.com/the-bread-and-bread-machine-cookbook-textcooks.pdf
    • http://www.gorillawalker.com/total-compensation-a-practical-guide-to-federal-employee-benefits.pdf
    • http://www.gorillawalker.com/miss-peregrine-s-home-for-peculiar-children-miss-peregrine-s.pdf
    • http://www.gorillawalker.com/land-use-problems-and-conflicts-causes-consequences-and-solutions-routledge.pdf
    • http://www.gorillawalker.com/nuclear-insights-the-cold-war-legacy-volume-2-nuclear-threats.pdf
    • http://www.gorillawalker.com/the-end-of-modernity-nihilism-and-hermeneutics-in-post-modern.pdf
    • http://www.gorillawalker.com/the-fossils-of-the-burgess-shale.pdf
    • http://www.gorillawalker.com/drawing-a-likeness.pdf
    • http://www.gorillawalker.com/cantemos-venezuelan-folk-carol.pdf
    • http://www.gorillawalker.com/this-is-the-earth.pdf
    • http://www.gorillawalker.com/how-to-win-the-pick-4-lottery-now.pdf
    • http://www.gorillawalker.com/fifty-lectures-for-american-mathematics-competitions-volume-1.pdf
    • http://www.gorillawalker.com/build-your-own-electric-bicycle-tab-green-guru-guides.pdf
    • http://www.gorillawalker.com/offl-urza-s-des-game-g-magic-the-gathering.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.