Malicious PDF — malware analysis report

Static analysis result for SHA-256 b665340dba2dbbe2…

MALICIOUS

PDF

44.4 KB Created: 2018-12-28 08:08:52 +03:00 Authoring application: Microsoft® Word 2016
MD5: 8db2484a1098dd330bd092b8e43268ac SHA-1: 87c0b93d105fde4c943b76ffab54a134d7d7db38 SHA-256: b665340dba2dbbe22165b7d4e23560b23ab16420eae479ac678c58fdca2ad2d2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a significant number of embedded external links, a technique often used for SEO manipulation or to host malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates a large number of external PDF links, with the first identified URL being http://www.gorillawalker.com/the-bonds-of-labor-german-journeys-to-the-working-world.pdf. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-bonds-of-labor-german-journeys-to-the-working-world.pdf
    • http://www.gorillawalker.com/living-with-decorative-textiles-tribal-arts-from-africa-asia-and.pdf
    • http://www.gorillawalker.com/terrorists-or-freedom-fighters-reflections-on-the-liberation-of-animals.pdf
    • http://www.gorillawalker.com/the-enemy-victor-the-assassin.pdf
    • http://www.gorillawalker.com/over-the-hill-mad-libs-adult-mad-libs.pdf
    • http://www.gorillawalker.com/aromatherapy-for-health-professionals-4e-price-aromatherapy-for-health-professionals.pdf
    • http://www.gorillawalker.com/flexible-plastic-packaging-in-poland-to-2015-market-profile-download.pdf
    • http://www.gorillawalker.com/travels-in-poland-russia-sweden-and-denmark-illustrated-with-charts.pdf
    • http://www.gorillawalker.com/the-stress-reduction-workbook-for-teens-mindfulness-skills-to-help.pdf
    • http://www.gorillawalker.com/knightly-legends-of-wales-or-the-boy-s-mabinogion-being.pdf
    • http://www.gorillawalker.com/england-countries-around-the-world.pdf
    • http://www.gorillawalker.com/the-complete-idiot-s-guide-to-wills-and-estates.pdf
    • http://www.gorillawalker.com/got-dogs-what-to-do-with-fido-when-you-travel.pdf
    • http://www.gorillawalker.com/get-started-in-danish-absolute-beginner-course-enhanced-edition.pdf
    • http://www.gorillawalker.com/just-for-kids-addresses-childhood-obesity-brief-article-an-article.pdf
    • http://www.gorillawalker.com/completely-breakfast-kindle-edition.pdf
    • http://www.gorillawalker.com/holt-short-stories-student-edition-impact-1996.pdf
    • http://www.gorillawalker.com/green-your-place-in-the-new-energy-revolution.pdf
    • http://www.gorillawalker.com/classic-word-fill-in-puzzles-volume-1.pdf
    • http://www.gorillawalker.com/deceased-mother-poems-and-funeral-poems-for-mother-kindle-edition.pdf
    • http://www.gorillawalker.com/the-adventures-of-cherokee.pdf
    • http://www.gorillawalker.com/pokemon-2015-square-12x12.pdf
    • http://www.gorillawalker.com/everybody-s-all-american.pdf
    • http://www.gorillawalker.com/the-legal-environment-of-translation.pdf
    • http://www.gorillawalker.com/mientras-los-hombres-mueren-carmen-conde-hispanic-texts-mup.pdf
    • http://www.gorillawalker.com/hatred-and-forgiveness-european-perspectives-a-series-in-social-thought.pdf
    • http://www.gorillawalker.com/spices-condiments-and-seasonings.pdf
    • http://www.gorillawalker.com/man-to-man-defense.pdf
    • http://www.gorillawalker.com/the-politics-of-reconciliation-zimbabwe-s-first-decade.pdf
    • http://www.gorillawalker.com/catholic-guide-to-depression.pdf
    • http://www.gorillawalker.com/6-shortcuts-to-employee-engagement-lead-succeed-in-a-do.pdf
    • http://www.gorillawalker.com/against-all-odds-my-story.pdf
    • http://www.gorillawalker.com/the-european-constitution-welfare-states-and-democracy-the-four-freedoms.pdf
    • http://www.gorillawalker.com/images-of-tunisia.pdf
    • http://www.gorillawalker.com/daoism-handbook-handbook-of-oriental-studies-handbuch-der-orientalisk-part.pdf
    • http://www.gorillawalker.com/the-mo.pdf
    • http://www.gorillawalker.com/client-outcomes-in-therapeutic-recreation-services.pdf
    • http://www.gorillawalker.com/the-assault-on-international-law-kindle-edition.pdf
    • http://www.gorillawalker.com/an-annotated-bibliography-of-the-united-states-marine-corps-concept.pdf
    • http://www.gorillawalker.com/prisoners-of-nazis-accounts-by-american-pows-in-world-war.pdf
    • http://www.gorillawalker.com/flexible-plastic-packaging-in-poland-to-2015-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.