Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab57336d9a052b44…

MALICIOUS

PDF

40.7 KB Created: 2018-12-02 10:56:02 +03:00 Authoring application: TeX (via pdfTeX-0.14f)
MD5: 094377d9a9778ca0d284f98472a8c83f SHA-1: 88b7a0daaf126d2fd02a7a7cf6852b56fe15e1b9 SHA-256: ab57336d9a052b44ff146b608604ed8aac7fa62f29079eeb3fbe1afb1faf8301
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files on the same domain, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a link farm or SEO manipulation tactic. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the document. No scripts were extracted from this sample, and the document body was not parsable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-collected-stories-of-isaac-bashevis-singer.pdf
    • http://www.gorillawalker.com/selected-political-writings.pdf
    • http://www.gorillawalker.com/making-sense-of-the-cross.pdf
    • http://www.gorillawalker.com/healing-the-adult-child-s-grieving-heart-100-practical-ideas.pdf
    • http://www.gorillawalker.com/creole-remedies-of-trinidad-and-tobago.pdf
    • http://www.gorillawalker.com/companion-encyclopedia-of-the-history-and-philosophy-of-the-mathematical.pdf
    • http://www.gorillawalker.com/security-law-and-methods.pdf
    • http://www.gorillawalker.com/spiritual-growth-from-milk-to-strong-meat.pdf
    • http://www.gorillawalker.com/socrates-and-alcibiades-four-texts-plato-s-alcibiades-i-ii.pdf
    • http://www.gorillawalker.com/investigating-firefly-and-serenity-science-fiction-on-the-frontier-investigating.pdf
    • http://www.gorillawalker.com/holt-ven-conmigo-practice-and-activity-book-en-camino.pdf
    • http://www.gorillawalker.com/honey-bunny-2016-mini-7x7.pdf
    • http://www.gorillawalker.com/a-mathematical-dictionary-for-schools.pdf
    • http://www.gorillawalker.com/ecotourism-programme-planning-cabi.pdf
    • http://www.gorillawalker.com/a-history-of-early-al-andalus-the-akhbar-majmu-a.pdf
    • http://www.gorillawalker.com/shook-over-hell-post-traumatic-stress-vietnam-and-the-civil.pdf
    • http://www.gorillawalker.com/measuring-performance-early-childhood-educator-in-practice.pdf
    • http://www.gorillawalker.com/25-most-treasured-gospel-hymn-stories.pdf
    • http://www.gorillawalker.com/time-for-kids-book-of-what-everything-inventions.pdf
    • http://www.gorillawalker.com/hagop-and-the-hairy-giant-the-armenian-version-of-jack.pdf
    • http://www.gorillawalker.com/le-manuel-de-la-vie-sauvage-ou-revivre-par-la.pdf
    • http://www.gorillawalker.com/raising-girls-why-girls-are-different-and-how-to-help.pdf
    • http://www.gorillawalker.com/place-school-counselor-41-exam-secrets-study-guide-place-test.pdf
    • http://www.gorillawalker.com/how-to-repair-diesel-engines.pdf
    • http://www.gorillawalker.com/a-century-of-george-burns-100-years-of-entertainment-4.pdf
    • http://www.gorillawalker.com/todo-buenos-aires-all-buenos-aires.pdf
    • http://www.gorillawalker.com/the-canterville-ghost.pdf
    • http://www.gorillawalker.com/advertising-to-children-on-tv-content-impact-and-regulation.pdf
    • http://www.gorillawalker.com/the-actor-and-his-body.pdf
    • http://www.gorillawalker.com/the-hollywood-connection-the-mafia-and-the-movie-business-the.pdf
    • http://www.gorillawalker.com/kinderwunschsprechstunde-german-edition.pdf
    • http://www.gorillawalker.com/muang-metaphysics-a-study-of-northern-thai-myth-and-ritual.pdf
    • http://www.gorillawalker.com/planning-for-learning-through-all-about-me-kindle-edition.pdf
    • http://www.gorillawalker.com/has-feminism-changed-science.pdf
    • http://www.gorillawalker.com/alfred-s-essentials-of-music-theory-a-complete-self-study.pdf
    • http://www.gorillawalker.com/the-riddle-of-the-titanic.pdf
    • http://www.gorillawalker.com/comic-art-8-issue-8.pdf
    • http://www.gorillawalker.com/analyzing-qualitative-data-systematic-approaches.pdf
    • http://www.gorillawalker.com/two-problems-of-marine-geology-atolls-and-canyons-verhandelingen-der.pdf
    • http://www.gorillawalker.com/woodland-knits-over-20-enchanting-patterns-tiny-owl-knits.pdf
    • http://www.gorillawalker.com/socrates-and-alcibiades-four-texts-plato-s-alcibiades-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.