Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba0996ce02a69b9c…

MALICIOUS

PDF

42.3 KB Created: 2019-03-17 08:23:24 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 9.0.0 (Windows))
MD5: a31adb195293f4d9a0ad2e52d1e7efcd SHA-1: 6268612043dc072f998fe6aa290d89ea9f14c0a2 SHA-256: ba0996ce02a69b9cb63b3d1e0506b9cb10711e1b37fc2c101c74b9aedaf0b497
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by an ML classifier and contains a large number of external links, indicating a potential link farm or distribution mechanism. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a coordinated effort to host or link to malicious content. No scripts were extracted, and the document body was unreadable, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/afternoon-tea-with-ease-kindle-edition.pdf
    • http://www.gorillawalker.com/three-heads-are-better-than-two-a-modern-gay-sex.pdf
    • http://www.gorillawalker.com/messages-from-the-wild-an-almanac-of-suburban-natural-and.pdf
    • http://www.gorillawalker.com/zeolites-synthesis-chemistry-and-applications-materials-science-and-technologies-chemical.pdf
    • http://www.gorillawalker.com/terror-tales-of-london.pdf
    • http://www.gorillawalker.com/college-cost-accounting.pdf
    • http://www.gorillawalker.com/inland-passage-on-boats-and-boating-in-the-northeast.pdf
    • http://www.gorillawalker.com/a-heart-like-ringo-starr-gravel-road-verse.pdf
    • http://www.gorillawalker.com/dream-it-do-it-disney-editions-deluxe.pdf
    • http://www.gorillawalker.com/quality-manual-and-quality-procedures-for-ansi-iso-iec-17025.pdf
    • http://www.gorillawalker.com/dk-ultimate-panoramic-atlas.pdf
    • http://www.gorillawalker.com/when-the-snow-melts-the-autobiography-of-cubby-broccoli.pdf
    • http://www.gorillawalker.com/the-mysterious-lindsey-lights-one-family-s-true-encounters-with.pdf
    • http://www.gorillawalker.com/spark-notes-richard-iii.pdf
    • http://www.gorillawalker.com/alice-the-world-of-shadow.pdf
    • http://www.gorillawalker.com/iso-9241-3-1992-ergonomic-requirements-for-office-work-with.pdf
    • http://www.gorillawalker.com/the-together-teacher-plan-ahead-get-organized-and-save-time.pdf
    • http://www.gorillawalker.com/where-s-the-puppy-onde-esta-o-caozinho-portuguese-edition.pdf
    • http://www.gorillawalker.com/the-tragic-vision-of-african-american-religion-black-religion-womanist.pdf
    • http://www.gorillawalker.com/fix-it-and-flip-it-how-to-make-money-rehabbing.pdf
    • http://www.gorillawalker.com/scriptures-of-the-world-s-religions.pdf
    • http://www.gorillawalker.com/eism-dchen-kriminalroman-ein-alice-quentin-thriller-3-german-edition.pdf
    • http://www.gorillawalker.com/life-cycle-assessment-pocketarchitecture.pdf
    • http://www.gorillawalker.com/dark-wishing-well.pdf
    • http://www.gorillawalker.com/secrets-of-minor-piece-endings-batsford-chess-library.pdf
    • http://www.gorillawalker.com/al-otro-lado-de-lo-imposible-en.pdf
    • http://www.gorillawalker.com/the-group-songbook-accompaniment-book.pdf
    • http://www.gorillawalker.com/pimsleur-italian-level-3-cd-learn-to-speak-and-understand.pdf
    • http://www.gorillawalker.com/razas-de-caballos-de-la-a-a-la-z-horse.pdf
    • http://www.gorillawalker.com/pasta-company-s-coming-company-s-coming.pdf
    • http://www.gorillawalker.com/practical-technology.pdf
    • http://www.gorillawalker.com/holt-pre-algebra-family-involvement-activities.pdf
    • http://www.gorillawalker.com/tundra-taiga-biology.pdf
    • http://www.gorillawalker.com/polyhedra-dice-games-grades-k-6.pdf
    • http://www.gorillawalker.com/animal-cells-as-bioreactors-cambridge-studies-in-biotechnology.pdf
    • http://www.gorillawalker.com/lighthouses-our-earth-collection.pdf
    • http://www.gorillawalker.com/focus-five-women-photographers-julia-margaret-cameron-margaret-bourke-white.pdf
    • http://www.gorillawalker.com/growing-shrubs-and-small-trees-in-cold-climates-revised-and.pdf
    • http://www.gorillawalker.com/developing-the-modern-footballer-through-futsal.pdf
    • http://www.gorillawalker.com/ellie-vayo-s-guide-to-boudoir-photography.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.