Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf5a5bb47303a22d…

MALICIOUS

PDF

33.2 KB Created: 2019-08-10 07:58:01 +03:00 Authoring application: (Infix Pro) (via PDFKit.NET 3.0.58.0)
MD5: d67fec583521c85e7c53f5db84534209 SHA-1: 2924d01adc02e8ac6542535a8cf204ec38141450 SHA-256: cf5a5bb47303a22d712da63e6e368c632251b836644864e44dffe909426a403f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or redirection tactic. The ML classifier also indicated a high probability of maliciousness. The embedded URLs point to various PDF documents hosted on the same domain, likely serving as a lure or a method to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/infants-and-children-books-a-la-carte-edition-plus-revel.pdf
    • http://www.gorillawalker.com/annuals-and-perennials-a-gardener-s-encyclopedia.pdf
    • http://www.gorillawalker.com/mathematical-diversions.pdf
    • http://www.gorillawalker.com/kim-k-an-abridged-portrait.pdf
    • http://www.gorillawalker.com/engineering-business-success-essential-lessons-in-building-a-thriving-company.pdf
    • http://www.gorillawalker.com/galgate-and-dolphinholme-pathfinder-maps.pdf
    • http://www.gorillawalker.com/summer-rambles-in-the-west.pdf
    • http://www.gorillawalker.com/god-sex-and-gender-an-introduction.pdf
    • http://www.gorillawalker.com/russia-s-wars-in-chechnya-1994-2009-essential-histories.pdf
    • http://www.gorillawalker.com/free-cockpit-displays-of-traffic-and-weather-information-effects-of.pdf
    • http://www.gorillawalker.com/mergers-acquisitions-and-takeovers-in-china-a-leagal-cultural-guide.pdf
    • http://www.gorillawalker.com/wulfhorst-martin-the-orchestral-violinist-s-companion-volumes-1-2.pdf
    • http://www.gorillawalker.com/the-illustrated-london-news-1917-1919-collected-works-of-gk.pdf
    • http://www.gorillawalker.com/the-love-match-entangled-scandalous-sisters-of-scandals-book-3.pdf
    • http://www.gorillawalker.com/connecting-with-parents-a-catechist-s-guide-to-involving-parents.pdf
    • http://www.gorillawalker.com/in-good-company-a-class-of-their-own-book-2.pdf
    • http://www.gorillawalker.com/scarecrow-shane-schofield.pdf
    • http://www.gorillawalker.com/prolactin-endocrine-updates.pdf
    • http://www.gorillawalker.com/nasty-secret-part-2-a-short-story-kindle-edition.pdf
    • http://www.gorillawalker.com/las-combinaciones-del-tarot-gu.pdf
    • http://www.gorillawalker.com/a-celtic-model-of-ministry-the-reawakening-of-community-spirituality.pdf
    • http://www.gorillawalker.com/value-prop-create-powerful-i3-value-propositions-to-enter-and.pdf
    • http://www.gorillawalker.com/gumshoe-america-hard-boiled-crime-fiction-and-the-rise-and.pdf
    • http://www.gorillawalker.com/a-guide-for-widows-and-widowers-how-to-get-your.pdf
    • http://www.gorillawalker.com/triage-x-vol-1.pdf
    • http://www.gorillawalker.com/the-bishop-s-secret.pdf
    • http://www.gorillawalker.com/holidays-in-britain-ireland-2004-a-guide-for-disabled-people.pdf
    • http://www.gorillawalker.com/history-of-the-italian-republics-in-the-middle-ages.pdf
    • http://www.gorillawalker.com/descent-into-darkness-darkness-revealed.pdf
    • http://www.gorillawalker.com/at-school-bobbie-kalman-s-leveled-readers-my-world-level.pdf
    • http://www.gorillawalker.com/hammer-nails.pdf
    • http://www.gorillawalker.com/concerto-for-harp-and-chamber-orchestra-piano-score.pdf
    • http://www.gorillawalker.com/the-1950s-and-1960s-costume-and-fashion-source-books.pdf
    • http://www.gorillawalker.com/claves-p-conpren-interpretar-el-i-ching-bolsillo-edaf-spanish.pdf
    • http://www.gorillawalker.com/venomous-snakes-envenoming-therapy-reptiles-classification-evolution-and-systems.pdf
    • http://www.gorillawalker.com/six-space-exploration-cards-dover-postcards.pdf
    • http://www.gorillawalker.com/shoes-objects-of-art-and-seduction.pdf
    • http://www.gorillawalker.com/safety-stock-planning-for-a-hong-kong-fashion-retailer-pearson.pdf
    • http://www.gorillawalker.com/bolivia-en-sus-diversas-fases-principalmente-economica-obra-ilustrada-con.pdf
    • http://www.gorillawalker.com/using-concurrent-engineering-for-better-product-development.pdf
    • http://www.gorillawalker.com/the-illustrated-london-news
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.