Malicious PDF — malware analysis report

Static analysis result for SHA-256 b4dade9f0a22549f…

MALICIOUS

PDF

43.4 KB Created: 2019-03-30 22:25:31 +03:00 Authoring application: - (via Mac OS X 10.6.7 Quartz PDFContext)
MD5: ebb83747bca4f10136e964bb1534dec1 SHA-1: b4f6370047fcc96cba9a46ff2622633335335487 SHA-256: b4dade9f0a22549f479d42451d4f0c695a6a25379fa64594d7c53fd370598ebe
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and a critical heuristic for containing a large number of external links. These links point to various PDF documents hosted on the same domain, suggesting a link farm or SEO manipulation tactic. The ML classifier's high score indicates a strong likelihood of malicious intent, though the specific payload or purpose beyond link distribution is not clear from the available data.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/fortran-iv-in-chemistry-an-introduction-to-computer-assisted-methods.pdf
    • http://www.gorillawalker.com/my-new-york-puzzle-the-statue-of-liberty.pdf
    • http://www.gorillawalker.com/freedom-national-the-destruction-of-slavery-in-the-united-states.pdf
    • http://www.gorillawalker.com/educational-leadership-for-ethics-and-social-justice-views-from-the.pdf
    • http://www.gorillawalker.com/little-black-classics-anthem-for-doomed-youth.pdf
    • http://www.gorillawalker.com/gumbo-ya-ya-a-collection-of-louisiana-folk-tales.pdf
    • http://www.gorillawalker.com/one-summer-america-1927-random-house-large-print.pdf
    • http://www.gorillawalker.com/the-six-healing-sounds-taoist-techniques-for-balancing-chi.pdf
    • http://www.gorillawalker.com/bird-eggs-birds.pdf
    • http://www.gorillawalker.com/corporate-income-taxation-in-europe-the-common-consolidated-corporate-tax.pdf
    • http://www.gorillawalker.com/practical-manual-of-wastewater-chemistry.pdf
    • http://www.gorillawalker.com/icd-9-cm-2012-office-edition-coder-s-choice-volumes.pdf
    • http://www.gorillawalker.com/effect-geomechanics-on-mine-design.pdf
    • http://www.gorillawalker.com/visual-century-volume-four-1990-150-2007-south-african-art.pdf
    • http://www.gorillawalker.com/hoodwinked-the-documents-that-reveal-how-bush-sold-us-a.pdf
    • http://www.gorillawalker.com/business-english-writing-in-the-global-workplace.pdf
    • http://www.gorillawalker.com/from-pea-to-pumpkin-a-pregnancy-journal.pdf
    • http://www.gorillawalker.com/design-of-small-canal-structures-1974-engineering-technology-pertaining-primarily.pdf
    • http://www.gorillawalker.com/portland-is-weird-365-unique-days-in-the-city-of.pdf
    • http://www.gorillawalker.com/justin-martyr-on-angels-demons-and-the-devil-justin-martyr.pdf
    • http://www.gorillawalker.com/einsteino-el-raton-leer-me-hace-inteligente-spanish-edition.pdf
    • http://www.gorillawalker.com/currency-wars-the-making-of-the-next-global-crisis-1st.pdf
    • http://www.gorillawalker.com/roni-horn-pi.pdf
    • http://www.gorillawalker.com/music-minus-one-trombone-easy-trombone-solos-vol-i.pdf
    • http://www.gorillawalker.com/squatters-and-the-roots-of-mau-mau-1905-63-eastern.pdf
    • http://www.gorillawalker.com/advances-in-elliptic-curve-cryptography-london-mathematical-society-lecture-note.pdf
    • http://www.gorillawalker.com/humane-behavioral-care-for-dogs-problem-prevention-and-treatment-dvd.pdf
    • http://www.gorillawalker.com/ecr-beziehungsmanagement-zwischen-industrie-und-handel-german-edition.pdf
    • http://www.gorillawalker.com/the-judiciary-tenth-edition.pdf
    • http://www.gorillawalker.com/cengage-advantage-books-understanding-arguments-concise-edition.pdf
    • http://www.gorillawalker.com/precious-moments-catholic-bible.pdf
    • http://www.gorillawalker.com/arts-and-crafts-furniture-projects-you-can-build-for-the.pdf
    • http://www.gorillawalker.com/the-baptist-heritage-four-centuries-of-baptist-witness.pdf
    • http://www.gorillawalker.com/vassily-ivanchuk-100-selected-games.pdf
    • http://www.gorillawalker.com/earth-chronicles-vol-1-when-the-earth-was-green.pdf
    • http://www.gorillawalker.com/1491-una-nueva-historia-de-la-americas-antes-de-colon.pdf
    • http://www.gorillawalker.com/practise-your-losing-trick-count-with-tom-townsend-bridge-plus.pdf
    • http://www.gorillawalker.com/at-the-movies-easy-keyboard-easy-keyboard-library.pdf
    • http://www.gorillawalker.com/applying-maths-in-the-chemical-and-biomolecular-sciences-an-example.pdf
    • http://www.gorillawalker.com/the-tragedy-in-a-tangled-talented-mind-the-writing-that.pdf
    • http://www.gorillawalker.com/the-six-healing-sound
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.