Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5dd3a07b21faee5…

MALICIOUS

PDF

43.4 KB Created: 2018-12-15 08:00:33 +03:00 Authoring application: Adobe InDesign CS5 (7.0.3) (via Adobe PDF Library 9.9)
MD5: d7af66901120dde0d50e16111371210e SHA-1: f79d73457a245a6562db8f00bcb07a5f33894ea1 SHA-256: b5dd3a07b21faee51f1c54a4c5bdea5e980bbb646e0198392819439d938f2bc7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a coordinated effort to manipulate search engine results or distribute content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/texes-pedagogy-and-professional-responsibilities-ec-12-practice-test-2.pdf
    • http://www.gorillawalker.com/the-summer-shack-cookbook-the-complete-guide-to-shore-food.pdf
    • http://www.gorillawalker.com/feynman-lectures-simplified-2a-maxwell-s-equations-electrostatics-everyone-s.pdf
    • http://www.gorillawalker.com/sexual-life-in-ottoman-society.pdf
    • http://www.gorillawalker.com/let-s-get-visible-how-to-get-noticed-and-sell.pdf
    • http://www.gorillawalker.com/the-iron-admiral-deception-ptorix-empire-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/the-philosophy-of-the-upanishads-and-ancient-indian-metaphysics.pdf
    • http://www.gorillawalker.com/prostitution-in-medieval-society-the-history-of-an-urban-institution.pdf
    • http://www.gorillawalker.com/optimization-of-aerosol-drug-delivery.pdf
    • http://www.gorillawalker.com/unconditional-parenting-moving-from-rewards-and-punishments-to-love-and.pdf
    • http://www.gorillawalker.com/dangerous-odds-my-secret-life-inside-an-illegal-billion-dollar.pdf
    • http://www.gorillawalker.com/explosives-and-demolitions.pdf
    • http://www.gorillawalker.com/african-american-folktales-stories-from-the-american-mosaic.pdf
    • http://www.gorillawalker.com/i-am-a-monument-on-learning-from-las-vegas.pdf
    • http://www.gorillawalker.com/trusts-law-essentials-the-edinburgh-law-essentials-eup.pdf
    • http://www.gorillawalker.com/lucky-us-a-novel.pdf
    • http://www.gorillawalker.com/the-complete-guide-to-repairing-and-restoring-furniture.pdf
    • http://www.gorillawalker.com/wind-energy-developments-in-the-20th-century.pdf
    • http://www.gorillawalker.com/nist-janaf-thermochemical-tables-2-volume-set-journal-of-physical.pdf
    • http://www.gorillawalker.com/grace-like-a-river-an-autobiography.pdf
    • http://www.gorillawalker.com/the-sultan-s-organ-london-to-constantinople-in-1599-and.pdf
    • http://www.gorillawalker.com/how-to-maximize-your-manhood-what-every-red-blooded-male.pdf
    • http://www.gorillawalker.com/sweden-supertouring-road-atlas-touristische-informationen-ortsregister-mit-postleitzahlen-citypl.pdf
    • http://www.gorillawalker.com/a-love-worth-giving-living-in-the-overflow-of-god.pdf
    • http://www.gorillawalker.com/timelock-the-caretaker-trilogy-book-3.pdf
    • http://www.gorillawalker.com/father-bear-s-special-day-maurice-sendak-s-little-bear.pdf
    • http://www.gorillawalker.com/happy-birthday-mad-libs.pdf
    • http://www.gorillawalker.com/european-road-trip-journal-armenia-flag-cover-s-m-road.pdf
    • http://www.gorillawalker.com/win32-api-reference-in-visual-c.pdf
    • http://www.gorillawalker.com/anarchist-periodicals-in-english-published-in-the-united-states-1833.pdf
    • http://www.gorillawalker.com/the-world-of-indicators-the-making-of-governmental-knowledge-through.pdf
    • http://www.gorillawalker.com/sport-for-development-what-game-are-we-playing.pdf
    • http://www.gorillawalker.com/leisure-and-aging-ulyssean-living-in-later-life.pdf
    • http://www.gorillawalker.com/the-road-to-assisi-the-essential-biography-of-st-francis.pdf
    • http://www.gorillawalker.com/this-book-will-teach-you-how-to-write-better-learn.pdf
    • http://www.gorillawalker.com/scottish-bicycles-and-tricycles.pdf
    • http://www.gorillawalker.com/biological-psychology-an-introduction-to-behavioral-cognitive-and-clinical-neuroscience.pdf
    • http://www.gorillawalker.com/side-chick-potion.pdf
    • http://www.gorillawalker.com/cutaneous-soft-tissue-tumors.pdf
    • http://www.gorillawalker.com/i-wanted-to-dance-carlos-gavito-life-passion-and-tango.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.