Malicious PDF — malware analysis report

Static analysis result for SHA-256 af74ba522441df17…

MALICIOUS

PDF

44.2 KB Created: 2018-12-15 20:47:18 +03:00 Authoring application: Adobe Acrobat 7.0 (via Adobe Acrobat 7.0 Image Conversion Plug-in)
MD5: aea0c65b7c3f6a201b05e62804d8910b SHA-1: 43aa05a4cd2fc068562990bfddca4df16d955e05 SHA-256: af74ba522441df17dc4f916919e4b5e2acbc3df120b1a683939e2d82e6cba97e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/ossian-bingley-hart-florida-s-loyalist-reconstruction-governor-southern-biography.pdf
    • http://www.gorillawalker.com/the-lord-of-the-rings-official-movie-guide.pdf
    • http://www.gorillawalker.com/the-mighty-engine-the-printing-press-and-its-impact-print.pdf
    • http://www.gorillawalker.com/straightforward-guide-to-the-rights-of-the-consumer.pdf
    • http://www.gorillawalker.com/bronica-systems-etr-si-sq-ai-gs-1-hove-user.pdf
    • http://www.gorillawalker.com/vitamins-and-hormones-volume-70-vitamins-hormones.pdf
    • http://www.gorillawalker.com/la-m-thode-six-sigma-de-l-entreprise-performante-comment.pdf
    • http://www.gorillawalker.com/economics-fourth-edition.pdf
    • http://www.gorillawalker.com/moon-spotlight-copan.pdf
    • http://www.gorillawalker.com/loopholes-of-real-estate-rich-dad-s-advisors-kindle-edition.pdf
    • http://www.gorillawalker.com/the-law-of-corporate-finance-general-principles-and-eu-law.pdf
    • http://www.gorillawalker.com/ethics-and-corporate-governance-an-australian-handbook.pdf
    • http://www.gorillawalker.com/the-civil-war-the-final-year-told-by-those-who.pdf
    • http://www.gorillawalker.com/una-mujer-del-reino-spanish-edition.pdf
    • http://www.gorillawalker.com/implementation-strategies-for-sap-r-3-in-a-multinational-organization.pdf
    • http://www.gorillawalker.com/restorative-justice-in-practice-evaluating-what-works-for-victims-and.pdf
    • http://www.gorillawalker.com/by-weight-watchers-weight-watchers-versatile-vegetarian-1st-first-edition.pdf
    • http://www.gorillawalker.com/the-grey-ghost-kindle-edition.pdf
    • http://www.gorillawalker.com/soup-of-the-day-williams-sonoma-365-recipes-for-every.pdf
    • http://www.gorillawalker.com/chinese-made-easy-for-kids-workbook-2-trad-ch-ed.pdf
    • http://www.gorillawalker.com/uncover-your-potential-you-are-more-than-you-realize.pdf
    • http://www.gorillawalker.com/direct-wood-sculpture-techniques-innovation-creativity.pdf
    • http://www.gorillawalker.com/b-p-r-d-vol-11-the-black-goddess.pdf
    • http://www.gorillawalker.com/gardening-in-the-coastal-south.pdf
    • http://www.gorillawalker.com/practical-furniture-design-by-paul-schurch.pdf
    • http://www.gorillawalker.com/orleans-charite-sur-loire-ign-green-series.pdf
    • http://www.gorillawalker.com/genetic-technologies-and-the-law-cases-and-materials-carolina-academic.pdf
    • http://www.gorillawalker.com/screendance-inscribing-the-ephemeral-image-paperback.pdf
    • http://www.gorillawalker.com/the-ingoldsby-legends-volume-2.pdf
    • http://www.gorillawalker.com/danger-on-vampire-trail-the-hardy-boys-no-50.pdf
    • http://www.gorillawalker.com/without-a-dowry-the-last-victim-and-other-plays-russian.pdf
    • http://www.gorillawalker.com/physical-distribution-management-logistics-of-the-firm-revised-edition-hardcover.pdf
    • http://www.gorillawalker.com/paleo-happy-hour-the-paleo-approach-to-small-plates-appetizers.pdf
    • http://www.gorillawalker.com/snowboard-2005-calendar.pdf
    • http://www.gorillawalker.com/chinatown-jeet-kune-do-essential-elements-of-bruce-lee-s.pdf
    • http://www.gorillawalker.com/exchanging-our-country-marks-the-transformation-of-african-identities-in.pdf
    • http://www.gorillawalker.com/medical-and-psychosocial-care-of-the-cancer-survivor.pdf
    • http://www.gorillawalker.com/readings-to-accompany-experience-humanities-volume-2-the-renaissance-to.pdf
    • http://www.gorillawalker.com/moving-picture-the-rickshaw-art-of-bangladesh.pdf
    • http://www.gorillawalker.com/songs-science-spirit.pdf
    • http://www.gorillawalker.com/loopholes-of
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.