Malicious PDF — malware analysis report

Static analysis result for SHA-256 b986709cb34c1aa8…

MALICIOUS

PDF

43.8 KB Created: 2019-03-16 14:06:48 +03:00 Authoring application: Microsoft Word: LaserWriter 8 8.6.5 (via Acrobat Distiller 4.0 for Macintosh)
MD5: bea9ee9f5b71cd4491ee3be303c38da7 SHA-1: ebef029c76a8150a3378033ded9acc6c384a580e SHA-256: b986709cb34c1aa8e5ca23849c513c414b8e27909e6ac9aa832a7f4da7b9fc12
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded external links to other PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document. While no scripts were extracted, the sheer volume of links suggests a malicious intent, possibly for SEO manipulation or to distribute further malware. The document body was heavily obfuscated and unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/boards-that-excel-candid-insights-and-practical-advice-for-directors.pdf
    • http://www.gorillawalker.com/with-russian-japanese-and-chunchuse-the-experiences-of-an-englishman.pdf
    • http://www.gorillawalker.com/geometry-and-measurement-grade-5.pdf
    • http://www.gorillawalker.com/tony-northrup-s-dslr-book-how-to-create-stunning-digital.pdf
    • http://www.gorillawalker.com/augustine-s-manichaean-dilemma-volume-2-making-a-catholic-self.pdf
    • http://www.gorillawalker.com/game-design.pdf
    • http://www.gorillawalker.com/knowledge-in-later-islamic-philosophy-mulla-sadra-on-existence-intellect.pdf
    • http://www.gorillawalker.com/protecting-president-lincoln-the-security-effort-the-thwarted-plots-and.pdf
    • http://www.gorillawalker.com/chronic-disease-epidemiology-and-control-3rd-edition.pdf
    • http://www.gorillawalker.com/powerpoint-and-coffee.pdf
    • http://www.gorillawalker.com/the-beanie-encyclopedia-a-complete-unofficial-guide-to-collecting-beanie.pdf
    • http://www.gorillawalker.com/seba-cabinet-of-natural-curiosities.pdf
    • http://www.gorillawalker.com/healing-skin-disorders-natural-treatments-for-dermatological-conditions.pdf
    • http://www.gorillawalker.com/humor-entertainment-and-popular-culture-during-world-war-i.pdf
    • http://www.gorillawalker.com/the-missing-peace-the-search-for-nonviolent-alternatives-in-united.pdf
    • http://www.gorillawalker.com/long-lonely-nights-the-protectors-1-siren-publishing-classic.pdf
    • http://www.gorillawalker.com/you-have-a-point-there-a-guide-to-punctuation-and.pdf
    • http://www.gorillawalker.com/trauma-healing-at-the-clay-field-a-sensorimotor-art-therapy.pdf
    • http://www.gorillawalker.com/good-man-is-easy-to-find-in-southern-california.pdf
    • http://www.gorillawalker.com/the-sky-club.pdf
    • http://www.gorillawalker.com/chopin-etudes-opus-25-for-the-piano-sheet-music.pdf
    • http://www.gorillawalker.com/gm-cars-2014-vintage-calendar.pdf
    • http://www.gorillawalker.com/first-solos-for-the-flute-player.pdf
    • http://www.gorillawalker.com/portland-storm-the-first-period.pdf
    • http://www.gorillawalker.com/starting-ukulele-book-cd.pdf
    • http://www.gorillawalker.com/cox-rings-cambridge-studies-in-advanced-mathematics.pdf
    • http://www.gorillawalker.com/subsea-pipelines-and-risers-ocean-engineering.pdf
    • http://www.gorillawalker.com/youth-futsal-skills-and-strategies-a-guide-for-players-coaches.pdf
    • http://www.gorillawalker.com/chinese-armorial-porcelain.pdf
    • http://www.gorillawalker.com/the-u-s-intervention-in-lebanon.pdf
    • http://www.gorillawalker.com/women-and-crafts-a-selective-annotated-bibliography.pdf
    • http://www.gorillawalker.com/where-in-the-alphabet-is-ethan-echidna.pdf
    • http://www.gorillawalker.com/sikhim-and-bhutan-twenty-one-years-on-the-north-east.pdf
    • http://www.gorillawalker.com/destination-iceland.pdf
    • http://www.gorillawalker.com/tell-me-the-story-redesign-a-story-for-eternity.pdf
    • http://www.gorillawalker.com/nhs-vacancies-survey-england-2014-15-nhs-jobs-based-proxy.pdf
    • http://www.gorillawalker.com/beastly-bible-re-programme-book-3.pdf
    • http://www.gorillawalker.com/preciada-marca-de-nacimiento-spanish-edition.pdf
    • http://www.gorillawalker.com/the-zuni-southwest-american-indians-forgotten-books.pdf
    • http://www.gorillawalker.com/ocular-pharmacology-and-therapeutics-a-primary-care-guide-1e.pdf
    • http://www.gorillawalke
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.