Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccd941e95ab39398…

MALICIOUS

PDF

46.2 KB Created: 2018-12-15 20:02:17 +03:00 Authoring application: PageMaker 6.5 (via Acrobat Distiller 3.01 for Windows)
MD5: c0a88804a24fddff8748a248b719e40f SHA-1: 2551ec65314de18110e103968cbffccbc3cfba63 SHA-256: ccd941e95ab39398ac97ace908ae66b64105b7516d10ba17c70fb95fa51e0300
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. The embedded URLs point to a single domain, suggesting a coordinated effort to manipulate search engine results or distribute content from a central location. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7914

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-egg-first-discovery.pdf
    • http://www.gorillawalker.com/science-action-labs-insects-hands-on-science-activities-ready-for.pdf
    • http://www.gorillawalker.com/quiddity-flight-kindle-edition.pdf
    • http://www.gorillawalker.com/radiographic-interpretation-for-the-small-animal-clinician.pdf
    • http://www.gorillawalker.com/zoloft-tablet-treats-depression-obsessive-compulsive-disorder-ocd-posttraumatic-stress.pdf
    • http://www.gorillawalker.com/behavioral-pharmacology.pdf
    • http://www.gorillawalker.com/evaluation-for-personal-injury-claims-best-practices-for-forensic-mental.pdf
    • http://www.gorillawalker.com/mount-mat-frame-sell-prepare-and-market-your-photography-for.pdf
    • http://www.gorillawalker.com/alfred-hitchcock-s-rear-window-cambridge-film-handbooks.pdf
    • http://www.gorillawalker.com/natural-supernaturalism-tradition-and-revolution-in-romantic-literature-norton-library.pdf
    • http://www.gorillawalker.com/the-amateurs-the-story-of-four-young-men-and-their.pdf
    • http://www.gorillawalker.com/outlines-of-biochemistry-the-organic-chemistry-and-the-physicochemical-reactions.pdf
    • http://www.gorillawalker.com/crookedest-railroad-in-the-world-california-s-mt-tamalpais-muir.pdf
    • http://www.gorillawalker.com/atlas-of-novel-tectonics.pdf
    • http://www.gorillawalker.com/the-role-of-erosion-and-sediment-transport-in-nutrient-and.pdf
    • http://www.gorillawalker.com/brandenburg-concerto-3-score-parts-eighth-note-publications.pdf
    • http://www.gorillawalker.com/anish-kapoor-shooting-into-the-corner.pdf
    • http://www.gorillawalker.com/qian-shou-qing-ren-jue-ju-mandarin-chinese-edition.pdf
    • http://www.gorillawalker.com/pioneers-of-interpersonal-psychoanalysis.pdf
    • http://www.gorillawalker.com/the-innovation-killer-how-what-we-know-limits-what-we.pdf
    • http://www.gorillawalker.com/welcome-to-the-n-h-k-vol-2-v-2.pdf
    • http://www.gorillawalker.com/kaplan-oat-review-notes-2007-edition.pdf
    • http://www.gorillawalker.com/five-families-mexican-case-studies-in-the-culture-of-poverty.pdf
    • http://www.gorillawalker.com/the-pleasure-hound-the-complete-serial-the-pleasure-hound-series.pdf
    • http://www.gorillawalker.com/top-10-florence-and-tuscany-eyewitness-top-10-travel-guides.pdf
    • http://www.gorillawalker.com/laser-focus-february-1969-ann-arbor-world-s-holography-capital.pdf
    • http://www.gorillawalker.com/homo-creator-technik-als-philosophische-herausforderung-german-edition.pdf
    • http://www.gorillawalker.com/confessions-of-an-okie-cop.pdf
    • http://www.gorillawalker.com/alphabet-city-centennial-book.pdf
    • http://www.gorillawalker.com/materiality-documents-of-contemporary-art.pdf
    • http://www.gorillawalker.com/1v-cmos-gm-c-filters-design-and-applications-analog-circuits.pdf
    • http://www.gorillawalker.com/girls-lean-back-everywhere-the-law-of-obscenity-and-the.pdf
    • http://www.gorillawalker.com/mexico-from-montezuma-to-the-fall-of-the-pri-second.pdf
    • http://www.gorillawalker.com/syria-the-case-for-non-intervention.pdf
    • http://www.gorillawalker.com/philosophers-of-capitalism-menger-mises-rand-and-beyond.pdf
    • http://www.gorillawalker.com/belgium-its-cities-with-a-photogravure-frontispiece-and-sixty-four.pdf
    • http://www.gorillawalker.com/velocity-studies-book-1-developmental-and-progressive-studies-for-flute.pdf
    • http://www.gorillawalker.com/the-broken-wings.pdf
    • http://www.gorillawalker.com/things-mother-used-to-make-188-quick-and-easy-recipes.pdf
    • http://www.gorillawalker.com/the-ignatian-tradition-spirituality-in-history.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.