Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae9ad83e553252e8…

MALICIOUS

PDF

47.5 KB Created: 2019-03-17 10:24:35 +03:00 Authoring application: PScript5.dll Version 5.2.2 (via iText 2.1.7 by 1T3XT) First seen: 2019-04-18
MD5: 263d4c2c450244bda346add294ba8b33 SHA-1: 58021560bbb20fa7934813031f36e9350afe3d92 SHA-256: ae9ad83e553252e83378622be387d6e6ae49918abd33279215b4f587fa4d36e3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be SEO manipulation or a link farm designed to drive traffic to a specific domain, potentially for distributing malware or phishing content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8013

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/riding-on-the-wild-side-hh-tales-of-adventure-in.pdf
    • http://www.gorillawalker.com/the-adolescent-dental-health-project-access-to-oral-health-care.pdf
    • http://www.gorillawalker.com/coin-folders-cents-lincoln-memorial-official-whitman-coin-folder.pdf
    • http://www.gorillawalker.com/going-bananas.pdf
    • http://www.gorillawalker.com/cats-calendar-2015-wall-calendars-animal-calendar-monthly-wall-calendar.pdf
    • http://www.gorillawalker.com/irwin-rippe-s-procedures-techniques-and-minimally-invasive-monitoring-in.pdf
    • http://www.gorillawalker.com/fundamentals-of-gas-shale-reservoirs.pdf
    • http://www.gorillawalker.com/machine-design.pdf
    • http://www.gorillawalker.com/the-asian-military-revolution-from-gunpowder-to-the-bomb-new.pdf
    • http://www.gorillawalker.com/flesh-to-bone.pdf
    • http://www.gorillawalker.com/the-nurse-s-role-in-medication-safety.pdf
    • http://www.gorillawalker.com/against-aggression-speeches-together-with-texts-of-treaties-and-of.pdf
    • http://www.gorillawalker.com/a-writer-s-repertoire.pdf
    • http://www.gorillawalker.com/hippolytus-the-bacchae-webster-s-romanian-thesaurus-edition.pdf
    • http://www.gorillawalker.com/in-dublin-s-fair-city-molly-murphy.pdf
    • http://www.gorillawalker.com/fantastic-four-vol-6-rising-storm.pdf
    • http://www.gorillawalker.com/analyse-des-dimensions-de-l-ouverture-emotionnelle-en-lien-avec.pdf
    • http://www.gorillawalker.com/en-teo-celebra-sant-jordi-catalan-edition.pdf
    • http://www.gorillawalker.com/braude-s-treasury-of-wit-and-humor.pdf
    • http://www.gorillawalker.com/the-disney-poster-the-animated-film-classics-from-mickey-mouse.pdf
    • http://www.gorillawalker.com/tallulah-s-tutu.pdf
    • http://www.gorillawalker.com/joseph-beuys-multiples.pdf
    • http://www.gorillawalker.com/fairyland.pdf
    • http://www.gorillawalker.com/comprehensive-review-in-clinical-neurology-a-multiple-choice-question-book.pdf
    • http://www.gorillawalker.com/operating-systems-design-and-implementation-second-edition.pdf
    • http://www.gorillawalker.com/avances-recientes-en-biotecnolog-a-vegetal-e-ingenier-a-gen.pdf
    • http://www.gorillawalker.com/israel-are-they-still-god-s-people.pdf
    • http://www.gorillawalker.com/the-complete-guide-to-machine-quilting-how-to-use-your.pdf
    • http://www.gorillawalker.com/helicopters-other-rotorcraft-since-1907-pocket-encyclopedia-of-world-aircraft.pdf
    • http://www.gorillawalker.com/gluten-free-raw-food-recipes-going-gluten-free.pdf
    • http://www.gorillawalker.com/thirteen-days-in-milan.pdf
    • http://www.gorillawalker.com/national-security-the-israeli-experience-praeger-security-international.pdf
    • http://www.gorillawalker.com/yestales-an-unauthorized-biography-of-rock-s-most-cosmic-band.pdf
    • http://www.gorillawalker.com/todo-el-sabor-de-japon-easy-japanese-cookbook-spanish-edition.pdf
    • http://www.gorillawalker.com/death-the-redheaded-woman-an-auction-block-mystery.pdf
    • http://www.gorillawalker.com/rumors-of-war-the-deck-const-part-one-kindle-edition.pdf
    • http://www.gorillawalker.com/for-the-love-of-a-dog-understanding-emotion-in-you.pdf
    • http://www.gorillawalker.com/mind-body-spirit-the-triangle-of-life.pdf
    • http://www.gorillawalker.com/mapping-and-naming-the-moon-a-history-of-lunar-cartography.pdf
    • http://www.gorillawalker.com/the-history-and-sources-of-conflict-of-laws-in-nigeria.pdf
    • http://www.gorillawalker.com/cats-calendar-2015
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.