Malicious PDF — malware analysis report

Static analysis result for SHA-256 b86d8eade0687217…

MALICIOUS

PDF

46.6 KB Created: 2018-11-15 19:34:44 +03:00 Authoring application: AdobePS5.dll Version 5.0.1 (via Acrobat Distiller 4.0 for Windows)
MD5: ca6eff824174cdd36706f9df109f1933 SHA-1: b4fa0cf43e11a872ab98ce1a43abf792726c922a SHA-256: b86d8eade06872178fc979c6f2a4585a2a6b6ade620a99d79757bda96543490c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or to distribute additional malicious content through the linked PDFs. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/by-ruth-ballweg-physician-assistant-a-guide-to-clinical-practice.pdf
    • http://www.gorillawalker.com/historical-dictionary-of-choral-music-historical-dictionaries-of-literature-and.pdf
    • http://www.gorillawalker.com/eensy-weensy-spider.pdf
    • http://www.gorillawalker.com/econometric-models-and-economic-forecasts.pdf
    • http://www.gorillawalker.com/the-southerner-s-cookbook-recipes-wisdom-and-stories.pdf
    • http://www.gorillawalker.com/ssat-elementary-250-analogies-practice-problems-testing-for-grades-3.pdf
    • http://www.gorillawalker.com/sukhoi-su-7-and-su17-20-22-fighter-bomber-family.pdf
    • http://www.gorillawalker.com/the-arrow-and-the-point-russell-and-wittgenstein-s-tractatus.pdf
    • http://www.gorillawalker.com/drop-zone.pdf
    • http://www.gorillawalker.com/no-more-nice-girl-power-sexuality-and-success-in-the.pdf
    • http://www.gorillawalker.com/behind-the-secret-window-a-memoir-of-a-hidden-childhood.pdf
    • http://www.gorillawalker.com/railroad-depots-of-southern-indiana-in-images-of-rail.pdf
    • http://www.gorillawalker.com/dog-in-the-manger.pdf
    • http://www.gorillawalker.com/bruce-gilden-stern-fotografie-english-and-german-edition.pdf
    • http://www.gorillawalker.com/the-mind-and-art-of-giovanni-battista-piranesi-painters-sculptors.pdf
    • http://www.gorillawalker.com/measurement-of-nursing-outcomes-volume-1-measuring-nursing-performance-in.pdf
    • http://www.gorillawalker.com/four-pistols.pdf
    • http://www.gorillawalker.com/the-governess-inspection-a-victorian-medical-bdsm-examination-a-victorian.pdf
    • http://www.gorillawalker.com/exordium-a-mass-effect-novelization.pdf
    • http://www.gorillawalker.com/governance.pdf
    • http://www.gorillawalker.com/histolog-a-con-correlaciones-funcionales-y-cl-nicas-spanish-edition.pdf
    • http://www.gorillawalker.com/agates-of-lake-superior-stunning-varieties-and-how-they-are.pdf
    • http://www.gorillawalker.com/an-uneasy-alliance-the-mathematics-research-center-at-the-university.pdf
    • http://www.gorillawalker.com/distributed-virtual-worlds.pdf
    • http://www.gorillawalker.com/the-ultimate-miner-s-guide-for-pc-cheats-glitches-hacks.pdf
    • http://www.gorillawalker.com/a-descriptive-account-of-the-island-of-jamaica-with-remarks.pdf
    • http://www.gorillawalker.com/theory-of-linear-operators-in-hilbert-space-dover-books-on.pdf
    • http://www.gorillawalker.com/leading-and-managing-archives-and-records-programs-strategies-for-success.pdf
    • http://www.gorillawalker.com/the-george-eastman-index-to-photographers-volume-2.pdf
    • http://www.gorillawalker.com/whitewashed.pdf
    • http://www.gorillawalker.com/how-right-you-are-jeeves-paperback.pdf
    • http://www.gorillawalker.com/you-ve-got-social-manners-party-pointers-from-a-to.pdf
    • http://www.gorillawalker.com/deliver-me-from-my-enemies-urban-books.pdf
    • http://www.gorillawalker.com/foundations-of-real-estate-development-financing-a-guide-to-public.pdf
    • http://www.gorillawalker.com/bundle-gamble-interpersonal-communication-electronic-version.pdf
    • http://www.gorillawalker.com/the-sound-of-gospel-bb-trumpet-bb-euphonium-tc.pdf
    • http://www.gorillawalker.com/kjv-ten-commandments-wall-chart-laminated.pdf
    • http://www.gorillawalker.com/architecture-at-the-end-of-the-earth-photographing-the-russian.pdf
    • http://www.gorillawalker.com/semi-automatic-ontology-development-processes-and-resources.pdf
    • http://www.gorillawalker.com/co-aytch-a-confederate-memoir-of-the-civil-war.pdf
    • http://www.gorillawalker.co
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.