Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6d0f91b544e598d…

MALICIOUS

PDF

43.9 KB Created: 2018-12-15 20:07:36 +03:00 Authoring application: FrameMaker 7.1 (via Acrobat Distiller 7.0.5 (Windows))
MD5: e27f384b448780be830030a0c7ced6b2 SHA-1: 484b55c86887bdc59fd1b301042386d59f1ab23c SHA-256: b6d0f91b544e598d72b720df8d6697179d251beee97901f612eb6ace083a8d97
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The primary purpose appears to be SEO manipulation or distributing a large volume of links, potentially leading to further malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/lord-arthur-savile-s-crime-and-other-stories.pdf
    • http://www.gorillawalker.com/like-butter-on-pancakes.pdf
    • http://www.gorillawalker.com/missionary-of-moderation-henry-melchior-muhlenberg-and-the-lutheran-church.pdf
    • http://www.gorillawalker.com/killer-poker-by-the-numbers-mathematical-edge-for-winning-play.pdf
    • http://www.gorillawalker.com/the-magician-s-lie.pdf
    • http://www.gorillawalker.com/creating-america-beginnings-through-reconstruction-student-edition-2005-2005.pdf
    • http://www.gorillawalker.com/sam-2013-assessment-training-and-projects-with-mindtap-reader-for.pdf
    • http://www.gorillawalker.com/midnight-flame.pdf
    • http://www.gorillawalker.com/secured-credit-a-systems-approach.pdf
    • http://www.gorillawalker.com/plasmonics-and-plasmonic-metamaterials-analysis-and-applications-world-scientific-series.pdf
    • http://www.gorillawalker.com/war-and-remembrance.pdf
    • http://www.gorillawalker.com/nanotechnology-volume-1.pdf
    • http://www.gorillawalker.com/the-imperial-challenge-quebec-and-britain-in-the-age-of.pdf
    • http://www.gorillawalker.com/futuro-artigiano-l-innovazione-nelle-mani-degli-italiani.pdf
    • http://www.gorillawalker.com/making-and-breaking-the-grid-a-graphic-design-layout-workshop.pdf
    • http://www.gorillawalker.com/tanzania-rwanda-burudi-nelles-map.pdf
    • http://www.gorillawalker.com/by-order-of-the-president-a-presidential-agent-novel-unabridged.pdf
    • http://www.gorillawalker.com/this-book-is-top-secret-a-collection-of-awesome-military.pdf
    • http://www.gorillawalker.com/home-cooking-with-charlie-trotter-gourmet-cook-book-club-selection.pdf
    • http://www.gorillawalker.com/the-wiley-blackwell-handbook-of-infant-development-volume-i-and.pdf
    • http://www.gorillawalker.com/architecture-in-france-1800-1900.pdf
    • http://www.gorillawalker.com/antonio-gramsci-vidas-rebeldes-rebel-lives.pdf
    • http://www.gorillawalker.com/a-fight-for-religious-freedom-a-lawyer-s-personal-account.pdf
    • http://www.gorillawalker.com/human-trafficking-exploring-the-international-nature-concerns-and-complexities.pdf
    • http://www.gorillawalker.com/a-history-of-the-us-blackline-masters-bk-9.pdf
    • http://www.gorillawalker.com/clinical-informatics.pdf
    • http://www.gorillawalker.com/encore-book-2-standard-literature-that-motivates-alfred-masterwork-editions.pdf
    • http://www.gorillawalker.com/the-capability-approach-for-medical-education-amee-guide-theories-in.pdf
    • http://www.gorillawalker.com/turner-prints-the-engraved-work-of-j-m-w-turner.pdf
    • http://www.gorillawalker.com/hep-c-handbook.pdf
    • http://www.gorillawalker.com/the-scorecard-the-official-point-system-for-keeping-score-in.pdf
    • http://www.gorillawalker.com/hitler-s-second-book-the-unpublished-sequel-to-mein-kampf.pdf
    • http://www.gorillawalker.com/mental-science-a-compendium-of-psychology-and-the-history-of.pdf
    • http://www.gorillawalker.com/the-time-teachers.pdf
    • http://www.gorillawalker.com/mini-box-of-recipes-java-jolt.pdf
    • http://www.gorillawalker.com/a-butterfly-s-life-reading-essentials-discovering-exploring-science.pdf
    • http://www.gorillawalker.com/modern-forests-statemaking-and-environmental-change-in-colonial-eastern-india.pdf
    • http://www.gorillawalker.com/the-conscience-of-a-lawyer-american-casebooks.pdf
    • http://www.gorillawalker.com/la-patisserie-de-pierre-herm-english-and-french-edition.pdf
    • http://www.gorillawalker.com/complete-kicking-the-ultimate-guide-to-kicks-for-martial-arts.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.