Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbd30b182dd081e7…

MALICIOUS

PDF

35.5 KB Created: 2020-01-17 19:18:28 +03:00 Authoring application: PageMaker 6.5 (via Acrobat Distiller 4.05 for Windows)
MD5: e6cd7fe7e76defcf6dee0cd6019544e1 SHA-1: 8ffa3ff7ebfce93d7559f11eafeeb5c345b4df32 SHA-256: bbd30b182dd081e74a39c568ef8e2740cf62d0745bb505c15a6d95bd52bd82eb
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The embedded URLs, all pointing to the same domain, suggest a link farm or a method to distribute content, potentially malicious, under the guise of legitimate-looking document titles. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8255

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/transmission-lines-in-digital-systems-for-emc-practitioners.pdf
    • http://www.gorillawalker.com/book-de-tour-art-of-the-101st-tour-de-france.pdf
    • http://www.gorillawalker.com/literary-butte.pdf
    • http://www.gorillawalker.com/the-gargoyle-code-lenten-letters-between-a-master-tempter-and.pdf
    • http://www.gorillawalker.com/home-advantage-social-class-and-parental-intervention-in-elementary-education.pdf
    • http://www.gorillawalker.com/raymond-chandler-the-high-window-a-bbc-full-cast-radio.pdf
    • http://www.gorillawalker.com/ghost-stories-volume-1.pdf
    • http://www.gorillawalker.com/energize-your-brain-change-your-life-an-introduction-to-exercise.pdf
    • http://www.gorillawalker.com/the-delaplaine-noam-chomsky-his-essential-quotations-delaplaine-essential-quotations.pdf
    • http://www.gorillawalker.com/aiming-for-liberty-the-past-present-and-future-of-freedom.pdf
    • http://www.gorillawalker.com/jerry-falwell-v-larry-flynt-the-first-amendment-on-trial.pdf
    • http://www.gorillawalker.com/jack-nichols-gay-pioneer-have-you-heard-my-message-glbt.pdf
    • http://www.gorillawalker.com/secret-vol-2.pdf
    • http://www.gorillawalker.com/the-jewish-sabbath-kindle-edition.pdf
    • http://www.gorillawalker.com/burn-rehabilitation-an-issue-of-physical-medicine-and-rehabilitation-clinics.pdf
    • http://www.gorillawalker.com/the-musician-s-soul-a-journey-examining-spirituality-for-performers.pdf
    • http://www.gorillawalker.com/electric-power-industry-in-nontechnical-language-pennwell-non-technical.pdf
    • http://www.gorillawalker.com/the-hunt-and-the-feast-a-life-of-ernest-hemingway.pdf
    • http://www.gorillawalker.com/the-bogeyman-next-door-a-mystery-suspense-cop-thriller-alexis.pdf
    • http://www.gorillawalker.com/emdr-in-the-treatment-of-adults-abused-as-children-norton.pdf
    • http://www.gorillawalker.com/echoes-of-glory-the-napoleonic-soldier-recreated-in-color-photographs.pdf
    • http://www.gorillawalker.com/color-management-quality-output-working-with-color-from-camera-to.pdf
    • http://www.gorillawalker.com/the-life-and-times-of-cavour-volume-1.pdf
    • http://www.gorillawalker.com/south-africa-insight-guides-ser.pdf
    • http://www.gorillawalker.com/if-i-were-a-cow.pdf
    • http://www.gorillawalker.com/the-white-negress-literature-minstrelsy-and-the-black-jewish-imaginary.pdf
    • http://www.gorillawalker.com/rpg-400-programming-on-the-as-400.pdf
    • http://www.gorillawalker.com/magnetic-resonance-bioeffects-safety-and-patient-management.pdf
    • http://www.gorillawalker.com/step-3-aa-making-a-decision-hazelden-classic-step-pamphlets.pdf
    • http://www.gorillawalker.com/development-of-nissan-variable-geometry-jet-turbocharger-sae.pdf
    • http://www.gorillawalker.com/broadcasting-bill-lords-3rd-sitting-tuesday-30-april-1996-morning.pdf
    • http://www.gorillawalker.com/data-driven-healthcare-how-analytics-and-bi-are-transforming-the.pdf
    • http://www.gorillawalker.com/assonance-iv-pour-alto-tuba-et-lectronique.pdf
    • http://www.gorillawalker.com/through-the-african-wilderness.pdf
    • http://www.gorillawalker.com/the-indispensable-pc-hardware-book-your-hardware-questions-answered.pdf
    • http://www.gorillawalker.com/the-seduction-game-i-team-novel-an.pdf
    • http://www.gorillawalker.com/thor-the-viking-god-of-thunder-myths-and-legends.pdf
    • http://www.gorillawalker.com/the-floating-island-plays.pdf
    • http://www.gorillawalker.com/how-to-excel-in-medical-school-by-saks-norma-s.pdf
    • http://www.gorillawalker.com/the-trace-formula-and-base-change-for-gl-3-lecture.pdf
    • http://www.gorillawalker.com/energize-your-brain-change-your
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.