Malicious PDF — malware analysis report

Static analysis result for SHA-256 ceaaf9af30c9f441…

MALICIOUS

PDF

41.3 KB Created: 2019-03-17 10:09:01 +03:00 Authoring application: - (via Mac OS X 10.6.7 Quartz PDFContext)
MD5: ac06d8e273947570877ce6ffc579aac9 SHA-1: a62b52ab8fe6d083a7a89236652390c3c24a9ae5 SHA-256: ceaaf9af30c9f44196b705d8e234453b51f2e41a92a177e241c3f65928345095
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm, likely intended for SEO manipulation or to distribute further malicious content via the numerous URLs. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/orvis-wingshooting-handbook-fully-revised-and-updated-proven-techniques-for.pdf
    • http://www.gorillawalker.com/the-l-ger-connection-book-7-genevieve-lenard.pdf
    • http://www.gorillawalker.com/scarlet-tides-the-moontide-quartet.pdf
    • http://www.gorillawalker.com/severe-slugging-in-offshore-production-systems-petroleum-science-and-technology.pdf
    • http://www.gorillawalker.com/the-new-york-times-weekends-guide.pdf
    • http://www.gorillawalker.com/the-oxford-german-dictionary-and-grammar.pdf
    • http://www.gorillawalker.com/a-divine-and-supernatural-light.pdf
    • http://www.gorillawalker.com/estasi-e-seduzione-italian-edition.pdf
    • http://www.gorillawalker.com/rumi-stories-for-young-adults-from-the-mathnawi-islamic-classics.pdf
    • http://www.gorillawalker.com/genetic-engineering-oxford-higher-education.pdf
    • http://www.gorillawalker.com/the-grand-tour-or-the-purloined-coronation-regalia-the-cecelia.pdf
    • http://www.gorillawalker.com/twixt-sirdar-and-menelik-an-account-of-a-year-s.pdf
    • http://www.gorillawalker.com/arthroscopy.pdf
    • http://www.gorillawalker.com/camiones-de-bombero-fire-trucks-ruedas-alas-y-agua-spanish.pdf
    • http://www.gorillawalker.com/dewalt-plumbing-code-reference-based-on-the-2006-international-plumbing.pdf
    • http://www.gorillawalker.com/writing-a-research-paper-a-step-by-step-approach.pdf
    • http://www.gorillawalker.com/the-food-lover-s-guide-to-pizza-and-pasta.pdf
    • http://www.gorillawalker.com/evaluating-outcomes-empirical-tools-for-effective-practice.pdf
    • http://www.gorillawalker.com/teaching-native-america-across-the-curriculum-a-critical-inquiry-counterpoints.pdf
    • http://www.gorillawalker.com/aquarius-horoscope-2015-volume-11.pdf
    • http://www.gorillawalker.com/securities-and-exchange-commission-programs-and-operations.pdf
    • http://www.gorillawalker.com/law-and-ethics-in-the-business-environment-south-western-legal.pdf
    • http://www.gorillawalker.com/the-photoshop-7-wow-book.pdf
    • http://www.gorillawalker.com/happily-ever-after-puffin-chapters.pdf
    • http://www.gorillawalker.com/the-wright-brothers-inventors-and-aviators-spirit-of-america-our.pdf
    • http://www.gorillawalker.com/celebration-breads-recipes-tales-and-traditions.pdf
    • http://www.gorillawalker.com/the-essential-hand-foot.pdf
    • http://www.gorillawalker.com/pathways-to-prayer.pdf
    • http://www.gorillawalker.com/david-fincher-interviews-conversations-with-filmmakers-series.pdf
    • http://www.gorillawalker.com/snakes-the-evolution-of-mystery-in-nature.pdf
    • http://www.gorillawalker.com/clinging-sea-horses-pull-ahead-books.pdf
    • http://www.gorillawalker.com/everything-under-the-sky.pdf
    • http://www.gorillawalker.com/getting-more-how-to-negotiate-to-achieve-your-goals-in.pdf
    • http://www.gorillawalker.com/federal-securities-laws-selected-statutes-rules-and-forms.pdf
    • http://www.gorillawalker.com/seeking-sophie.pdf
    • http://www.gorillawalker.com/taekwondo-martial-arts-martial-arts-chelsea-house.pdf
    • http://www.gorillawalker.com/my-kindle-fire-hd.pdf
    • http://www.gorillawalker.com/social-theory-and-methodology-the-logic-of-social-enquiry-international.pdf
    • http://www.gorillawalker.com/gnrh-the-master-molecule-of-reproduction.pdf
    • http://www.gorillawalker.com/the-better-world-shopping-guide-every-dollar-makes-a-difference.pdf
    • http://www.gorillawalker.com/the-oxford-german-dictionary
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.