Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0250af6cf668eb8…

MALICIOUS

PDF

32.7 KB Created: 2020-03-12 17:17:45 +03:00 Authoring application: Acrobat PDFMaker 9.1 для Word (via Adobe PDF Library 9.0)
MD5: 94cf9823bac2a8462736c32a5c131fd8 SHA-1: 7ce35ed3dc36459717eff9820a12e32869dc7d81 SHA-256: c0250af6cf668eb875fe621128dae18e09790935b0d40828b7d9b83f71fe1e1e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains a significant number of embedded URLs. The heuristic 'PDF_SEO_LINK_FARM' indicates that these links are likely part of a scheme to manipulate search engine results or distribute malicious content, rather than serving a legitimate user purpose. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/growing-media-for-ornamental-plants-and-turf.pdf
    • http://www.gorillawalker.com/deserving-desire-women-s-stories-of-sexual-evolution.pdf
    • http://www.gorillawalker.com/human-learning-5th-edition.pdf
    • http://www.gorillawalker.com/mandamiento-olvidado-sed-santos-spanish-edition.pdf
    • http://www.gorillawalker.com/the-voyages-of-the-discovery-the-illustrated-history-of-scott.pdf
    • http://www.gorillawalker.com/archer-2014-wall-calendar.pdf
    • http://www.gorillawalker.com/wind-and-stone-rock-spring-collection-of-japanese-literature.pdf
    • http://www.gorillawalker.com/pure-green-100-delicious-green-smoothie-recipes-for-a-sexier.pdf
    • http://www.gorillawalker.com/i-acted-from-principle-the-civil-war-diary-of-dr.pdf
    • http://www.gorillawalker.com/the-devil-and-the-detective-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/how-to-draw-vampires-pocket-manga-how-to-draw-manga.pdf
    • http://www.gorillawalker.com/el-lenguaje-ritual-en-el-palo-monte-mayombe-colecci.pdf
    • http://www.gorillawalker.com/maternity-women-s-health-care-9e-maternity-and-women-s.pdf
    • http://www.gorillawalker.com/i-never-said-i-wasn-t-difficult.pdf
    • http://www.gorillawalker.com/stem-cells-for-dummies.pdf
    • http://www.gorillawalker.com/the-interplay-of-narrative-and-lyric-competition-cooperation-and-the.pdf
    • http://www.gorillawalker.com/medical-informatics-an-executive-primer.pdf
    • http://www.gorillawalker.com/kubota-kubota-g5200-service-manual-special-order.pdf
    • http://www.gorillawalker.com/flowers-for-rosita-a-john-rock-mystery.pdf
    • http://www.gorillawalker.com/peking-to-paris.pdf
    • http://www.gorillawalker.com/my-tooth-ith-loothe-funny-poems-to-read-instead-of.pdf
    • http://www.gorillawalker.com/the-small-investor-a-beginner-s-guide-to-stocks-bonds.pdf
    • http://www.gorillawalker.com/farhang-moaser-english-persian-and-persian-english-dictionary-english-and.pdf
    • http://www.gorillawalker.com/the-isle-of-where-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/interfacial-aspects-of-phase-transformations-proceedings-of-the-nato-advanced.pdf
    • http://www.gorillawalker.com/design-research-in-information-systems-theory-and-practice-integrated-series.pdf
    • http://www.gorillawalker.com/the-oxford-handbook-of-british-philosophy-in-the-eighteenth-century.pdf
    • http://www.gorillawalker.com/favourite-poems-of-the-sea.pdf
    • http://www.gorillawalker.com/drop-in-volume-one-tony-hawk-s-900-revolution.pdf
    • http://www.gorillawalker.com/genuine-narrative-of-the-intended-conspiracy-of-the-negroes-at.pdf
    • http://www.gorillawalker.com/clarkes-commentary-job-malachi.pdf
    • http://www.gorillawalker.com/dynamics-of-ice-sheets-and-glaciers-advances-in-geophysical-and.pdf
    • http://www.gorillawalker.com/sammelband-erpresser-und-voyeure-bdsm-zehn-erotische-bdsm-geschichten-german.pdf
    • http://www.gorillawalker.com/thelonious-monk-fake-book-c-edition-fake-books.pdf
    • http://www.gorillawalker.com/a-tower-in-babel-a-history-of-broadcasting-in-the.pdf
    • http://www.gorillawalker.com/multiple-choice-questions-to-prepare-for-the-ap-calculus-ab.pdf
    • http://www.gorillawalker.com/final-journeys-a-practical-guide-for-bringing-care-and-comfort.pdf
    • http://www.gorillawalker.com/summer-blue.pdf
    • http://www.gorillawalker.com/the-natures-of-john-and-william-bartram-pennsylvania-paperbacks.pdf
    • http://www.gorillawalker.com/number-properties-gre-strategy-guide-4th-edition-manhattan-prep-strategy.pdf
    • http://www.gorillawalker.com/how-to-draw-vampires-pocket-manga-ho
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.