Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb61a52c50824e6b…

MALICIOUS

PDF

40.4 KB Created: 2018-12-02 10:56:49 +03:00 Authoring application: FrameMaker 5.5.6p145 (via Acrobat Distiller 6.0 (Windows))
MD5: f66b6732bddd67fe9e3b83f595619c21 SHA-1: 8accca970c483758cc544a41af2c1f1b5c9db59b SHA-256: cb61a52c50824e6b6bcbd931d2e5f16ce2c67bb22744929d9c902ee68f6451d7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm, likely intended to manipulate search engine results or to distribute additional malicious content through the linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/life-in-the-ancient-indus-river-valley-peoples-of-the.pdf
    • http://www.gorillawalker.com/changed-into-his-likeness-kindle-edition.pdf
    • http://www.gorillawalker.com/review-copy.pdf
    • http://www.gorillawalker.com/alberta-provinces-and-territories-of-canada.pdf
    • http://www.gorillawalker.com/moon-our-solar-system-compass.pdf
    • http://www.gorillawalker.com/outline-light-and-shadow-on-bud-drawspace-module-5-1.pdf
    • http://www.gorillawalker.com/my-office-is-killing-me-the-sick-building-survival-guide.pdf
    • http://www.gorillawalker.com/somalia-summary-map-sudoc-prex-3-10-4-so-5.pdf
    • http://www.gorillawalker.com/buddhism-for-beginners-a-practical-guide-to-mindfulness-awakening-for.pdf
    • http://www.gorillawalker.com/the-ethel-cotton-course-in-conversation-the-fascinating-new-way.pdf
    • http://www.gorillawalker.com/the-prosper-school-pathways-for-student-wellbeing-policy-and-practices.pdf
    • http://www.gorillawalker.com/enjoying-big-bend-national-park-a-friendly-guide-to-adventures.pdf
    • http://www.gorillawalker.com/the-ugly-pugling-wilson-the-pug-in-love.pdf
    • http://www.gorillawalker.com/flute-sonata-in-e-flat-major-bwv-1031-classical-play.pdf
    • http://www.gorillawalker.com/click-the-forces-behind-how-we-fully-engage-with-people.pdf
    • http://www.gorillawalker.com/deadman-wonderland-vol-13.pdf
    • http://www.gorillawalker.com/sisters-and-brothers-the-ultimate-guide-to-understanding-your-siblings.pdf
    • http://www.gorillawalker.com/in-defense-of-globalization-with-a-new-afterword.pdf
    • http://www.gorillawalker.com/the-lie-the-skyy-huntington-series-volume-1.pdf
    • http://www.gorillawalker.com/mystical-languages-of-unsaying-national-bureau-of-economic-research.pdf
    • http://www.gorillawalker.com/next-generation-antidepressants-cambridge-medicine-kindle-edition.pdf
    • http://www.gorillawalker.com/integral-astrology-understanding-the-ancient-discipline-in-the-contemporary-world.pdf
    • http://www.gorillawalker.com/after-the-american-century-the-ends-of-u-s-culture.pdf
    • http://www.gorillawalker.com/patterns-of-exposition-17th-edition.pdf
    • http://www.gorillawalker.com/ship-stability-for-masters-and-mates-sixth-edition.pdf
    • http://www.gorillawalker.com/8-degrees-of-ingredients.pdf
    • http://www.gorillawalker.com/u-s-department-of-commerce-coast-and-geodetic-survey-special.pdf
    • http://www.gorillawalker.com/des-knaben-wunderhorn-wer-hat-dies-liedlein-erdacht-high-voice.pdf
    • http://www.gorillawalker.com/remarkable-lgbtq-lives.pdf
    • http://www.gorillawalker.com/crimson-shadows.pdf
    • http://www.gorillawalker.com/bittersweet-love-edy-book-two.pdf
    • http://www.gorillawalker.com/she-loved-everyone-but-me.pdf
    • http://www.gorillawalker.com/silent-assassin-a-dan-morgan-thriller-kindle-edition.pdf
    • http://www.gorillawalker.com/antimicrobials-and-agriculture-studies-in-the-agricultural-food-sciences.pdf
    • http://www.gorillawalker.com/das-ebook-profit-kraftpaket-produkt-creations-pack-5-german-edition.pdf
    • http://www.gorillawalker.com/army-techniques-publication-atp-4-43-fm-10-67-petroleum.pdf
    • http://www.gorillawalker.com/alone-at-home-with-the-alpha-billionaire-taboo-bdsm-spanking.pdf
    • http://www.gorillawalker.com/realistic-watercolor-portraits-how-to-paint-a-variety-of-ages.pdf
    • http://www.gorillawalker.com/bonk-the-curious-coupling-of-sex-and-science.pdf
    • http://www.gorillawalker.com/terms-and-conditions.pdf
    • http://www.gorillawalker.com/my-office-is-killing-me-the-sick-building-su
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.