Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6d2ab500c95d838…

MALICIOUS

PDF

39.7 KB Created: 2018-12-11 20:45:31 +03:00 Authoring application: FrameMaker 5.5.6p145 (via Acrobat Distiller 6.0 (Windows))
MD5: e5402374b3851125a48496b67fb57fee SHA-1: 29258e5f087302ad3a4769aa3623434aeec37c7a SHA-256: b6d2ab500c95d83852ad28676a1a2595fe30af72fcce7e7226e2f908be306e6c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, suggesting a link farm or a method to distribute content through a large number of seemingly legitimate documents. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/animal-homing-chapman-hall-animal-behaviour-series.pdf
    • http://www.gorillawalker.com/a-listening-church-autonomy-and-communion-in-african-churches.pdf
    • http://www.gorillawalker.com/action-philosophers-giant-size-thing-vol-3.pdf
    • http://www.gorillawalker.com/mindful-ecotherapy-handbook.pdf
    • http://www.gorillawalker.com/what-we-bury-at-night-disposable-humanity.pdf
    • http://www.gorillawalker.com/t-e-hulme-and-the-question-of-modernism.pdf
    • http://www.gorillawalker.com/the-maple-house-the-true-story-of-a-haunting.pdf
    • http://www.gorillawalker.com/naked-trevor.pdf
    • http://www.gorillawalker.com/mountaineering-in-the-moroccan-high-atlas-cicerone-guides.pdf
    • http://www.gorillawalker.com/my-real-castles-in-spain.pdf
    • http://www.gorillawalker.com/against-the-tide-kindle-edition.pdf
    • http://www.gorillawalker.com/spatiotemporal-data-analysis.pdf
    • http://www.gorillawalker.com/women-s-anatomy-of-arousal.pdf
    • http://www.gorillawalker.com/head-neck-and-orofacial-infections-a-multidisciplinary-approach-1e.pdf
    • http://www.gorillawalker.com/beginning-japanese-part-2.pdf
    • http://www.gorillawalker.com/prayers-that-avail-much-for-women.pdf
    • http://www.gorillawalker.com/weird-but-true-2-300-outrageous-facts.pdf
    • http://www.gorillawalker.com/brevis-linguae-syriacae-grammatica-litteratura-chrestomathia-cum-glossario-german-edition.pdf
    • http://www.gorillawalker.com/handbook-of-pulp-and-paper-technology.pdf
    • http://www.gorillawalker.com/outlaw-trail-the-gunsmith-book-66-kindle-edition.pdf
    • http://www.gorillawalker.com/follow-the-lights-piano-fun.pdf
    • http://www.gorillawalker.com/oppy-stops-the-hopping-popper.pdf
    • http://www.gorillawalker.com/the-hobbit-prima-s-official-strategy-guide.pdf
    • http://www.gorillawalker.com/the-hunting-wasp.pdf
    • http://www.gorillawalker.com/modernism-satire-and-the-novel.pdf
    • http://www.gorillawalker.com/wuthering-heights-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/larousse-los-clasicos-de-la-cocina-mexicana-larousse-classics-of.pdf
    • http://www.gorillawalker.com/garden-cuisine-heal-yourself-through-low-fat-meatless-eating.pdf
    • http://www.gorillawalker.com/comprehensive-virology-7-reproduction.pdf
    • http://www.gorillawalker.com/barcelona-city-guide-sightseeing-hotel-restaurant-shopping-highlights-illustrated.pdf
    • http://www.gorillawalker.com/do-bicycles-equal-development-in-mozambique.pdf
    • http://www.gorillawalker.com/growth-inflation-and-other-issues.pdf
    • http://www.gorillawalker.com/independence-day-let-s-see-library.pdf
    • http://www.gorillawalker.com/ten-stupid-things-women-do-to-mess-up-their-lives.pdf
    • http://www.gorillawalker.com/my-family-is-awesome.pdf
    • http://www.gorillawalker.com/pink-and-green-jungle-flowers-bible-cover.pdf
    • http://www.gorillawalker.com/starting-out-with-c-from-control-structures-through-objects-brief.pdf
    • http://www.gorillawalker.com/outsmarting-diabetes-a-dynamic-approach-for-reducing-the-effects-of.pdf
    • http://www.gorillawalker.com/ulysses-travel-washington-d-c-ulysses-travel-guide-french-guides.pdf
    • http://www.gorillawalker.com/cyborg-seduction-beneath-steel-1.pdf
    • http://www.gorillawalker.com/the-m
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.