Malicious PDF — malware analysis report

Static analysis result for SHA-256 c18d9c0a9398cc96…

MALICIOUS

PDF

40.4 KB Created: 2019-03-18 07:47:21 +03:00 Authoring application: Adobe InDesign CS2 (4.0) (via Adobe PDF Library 7.0)
MD5: f91f8d4180cafbba647ef59f3c898ff3 SHA-1: 8680b43119f9e029c9f297b7126c7feb833b2d2a SHA-256: c18d9c0a9398cc96fc6aaed85cb478c280fc66f08d7e893f3052eb4029a12b3a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with a high probability. The document body, though heavily obfuscated, contains references to these external URLs, suggesting a link farm or redirection scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/therapeutic-endoscopy-and-radiology-of-the-gut.pdf
    • http://www.gorillawalker.com/the-red-hen.pdf
    • http://www.gorillawalker.com/business-communication-process-product-custom-edition.pdf
    • http://www.gorillawalker.com/knoche-s-law-kindle-edition.pdf
    • http://www.gorillawalker.com/idaho-whitewater-the-complete-river-guide.pdf
    • http://www.gorillawalker.com/index-islamicus.pdf
    • http://www.gorillawalker.com/daddies-and-daughters.pdf
    • http://www.gorillawalker.com/wreck-of-the-nebula-dream-a-sectors-sf-romance-kindle.pdf
    • http://www.gorillawalker.com/evelyn-waugh-and-the-modernist-tradition-library-of-conservative-thought.pdf
    • http://www.gorillawalker.com/moon-yosemite-sequoia-kings-canyon-moon-handbooks.pdf
    • http://www.gorillawalker.com/new-york-city-local-law-33-of-2007-the-construction.pdf
    • http://www.gorillawalker.com/the-enneagram-development-guide.pdf
    • http://www.gorillawalker.com/developmentally-based-psychotherapy.pdf
    • http://www.gorillawalker.com/embattled-home-lost-and-found-volume-3.pdf
    • http://www.gorillawalker.com/yi-jiu-jiujiu-zang-xing-bi-ji-a-journal-on.pdf
    • http://www.gorillawalker.com/the-american-in-holland-sentimental-rambles-in-the-eleven-provinces.pdf
    • http://www.gorillawalker.com/lasers-in-surgery-advanced-characterization-therapeutics-and-systems-x-proceedings.pdf
    • http://www.gorillawalker.com/from-machine-to-machine-to-the-internet-of-things-introduction.pdf
    • http://www.gorillawalker.com/heaven-nor-hell.pdf
    • http://www.gorillawalker.com/mcdougal-littell-math-connections-student-edition-grades-7-8-2001.pdf
    • http://www.gorillawalker.com/patty-s-toxicology.pdf
    • http://www.gorillawalker.com/the-anger-aggression-workbook-reproducible-self-assessments-exercises-educational-handouts.pdf
    • http://www.gorillawalker.com/olivia-s-story.pdf
    • http://www.gorillawalker.com/old-testament-reading-plan-workbook-level-i-middle-school-student.pdf
    • http://www.gorillawalker.com/acsm-s-resources-for-the-personal-trainer.pdf
    • http://www.gorillawalker.com/paleo-freezer-recipes-and-paleo-mexican-recipes-2-book-combo.pdf
    • http://www.gorillawalker.com/wild-bill-and-intrepid-donovan-stephenson-and-the-origin-of.pdf
    • http://www.gorillawalker.com/a-bit-of-rough-rough-series-book-1.pdf
    • http://www.gorillawalker.com/law-firm-strategies-for-the-21st-century-strategies-for-success.pdf
    • http://www.gorillawalker.com/christmas-in-new-york.pdf
    • http://www.gorillawalker.com/the-language-and-music-of-the-wolves-a-project-of.pdf
    • http://www.gorillawalker.com/vessels-of-honor-a-novel.pdf
    • http://www.gorillawalker.com/sewing-modkid-style-modern-threads-for-the-cool-girl.pdf
    • http://www.gorillawalker.com/prophecy.pdf
    • http://www.gorillawalker.com/land-use-in-a-nutshell.pdf
    • http://www.gorillawalker.com/dark-wind-a-survivor-s-tale-of-love-and-loss.pdf
    • http://www.gorillawalker.com/the-perfect-stranger-kindle-edition.pdf
    • http://www.gorillawalker.com/growing-healthy.pdf
    • http://www.gorillawalker.com/wicca-witchcraft-magick-and-spells-the-complete-wicca-beginners-guide.pdf
    • http://www.gorillawalker.com/the-single-malt-whisky-companion-a-connoisseur-s-guide.pdf
    • http://www.gorillawal
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.