Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1dee82e83ed6437…

MALICIOUS

PDF

40.2 KB Created: 2018-12-02 10:55:54 +03:00 Authoring application: Microsoft Word (via Acrobat PDFWriter 3.0f1r8 for Power Macintosh)
MD5: 02b9bf432a386dcd657d5cb5f3134674 SHA-1: e0186230552863d8c5d3bd8a05a5aad7806ebd09 SHA-256: d1dee82e83ed64370107079186dae7c38c580efc76c7bdd400197ad178bdd971
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, a technique often used for SEO manipulation or to host malicious content. The primary heuristic identified a PDF link farm, suggesting the document's purpose is to distribute or redirect to other potentially harmful files. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9526

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/rebuilding-yemen-political-economic-and-social-challenges.pdf
    • http://www.gorillawalker.com/castle-ruins-of-medieval-england-and-wales-vital-g-vital.pdf
    • http://www.gorillawalker.com/bible-cover-large-study-burgundy.pdf
    • http://www.gorillawalker.com/the-biology-of-belief-unleashing-the-power-of-consciousness-matter.pdf
    • http://www.gorillawalker.com/praise-prayers.pdf
    • http://www.gorillawalker.com/spirituals-for-upper-voices-vocal-score.pdf
    • http://www.gorillawalker.com/brown-cow-green-grass-yellow-mellow-sun.pdf
    • http://www.gorillawalker.com/forced-hot-air-furnaces-troubleshooting-and-repair.pdf
    • http://www.gorillawalker.com/101-tips-on-nutrition-for-people-with-diabetes.pdf
    • http://www.gorillawalker.com/calculating-curves-the-mathematics-history-and-aesthetic-appeal-of-t.pdf
    • http://www.gorillawalker.com/the-new-history-confessions-and-conversations.pdf
    • http://www.gorillawalker.com/designage-the-art-of-the-decorative-sign.pdf
    • http://www.gorillawalker.com/l-p-gartner-s-phd-j-l-hiatt-phd-s.pdf
    • http://www.gorillawalker.com/the-wounded-warrior-a-survival-guide-for-when-you-re.pdf
    • http://www.gorillawalker.com/photography-in-california-1945-1980.pdf
    • http://www.gorillawalker.com/dying-bereavement-and-the-healing-arts.pdf
    • http://www.gorillawalker.com/administrative-law-cases-and-materials.pdf
    • http://www.gorillawalker.com/managing-human-behavior-in-public-and-nonprofit-organizations.pdf
    • http://www.gorillawalker.com/multisensor-systems-for-chemical-analysis-materials-and-sensors.pdf
    • http://www.gorillawalker.com/sports-psychology-a-self-help-guide.pdf
    • http://www.gorillawalker.com/curating-merida-city-notebook-for-merida-mexico-a-d-i.pdf
    • http://www.gorillawalker.com/compressors-and-modern-process-applications.pdf
    • http://www.gorillawalker.com/the-early-years-of-a-dutch-colonial-mission-the-karo.pdf
    • http://www.gorillawalker.com/structure-reports-organic-section-structure-reports-b.pdf
    • http://www.gorillawalker.com/until-the-end-the-3rd-maris-middleton-mystery-maris-middleton.pdf
    • http://www.gorillawalker.com/stereotactic-radiosurgery-and-stereotactic-body-radiation-therapy-imaging-in-medical.pdf
    • http://www.gorillawalker.com/legal-writing-in-a-nutshell.pdf
    • http://www.gorillawalker.com/saunders-manual-of-medical-practice-2e.pdf
    • http://www.gorillawalker.com/secrets-of-signals-intelligence-during-the-cold-war-and-beyond.pdf
    • http://www.gorillawalker.com/to-lhasa-and-beyond-diary-of-the-expedition-to-tibet.pdf
    • http://www.gorillawalker.com/the-making-of-indian-diplomacy-a-critique-of-eurocentrism.pdf
    • http://www.gorillawalker.com/a-history-of-ottoman-poetry-volume-iv-1700-1850.pdf
    • http://www.gorillawalker.com/armed-forces-devotional-book.pdf
    • http://www.gorillawalker.com/basic-essentials-weather-forecasting-3rd-edition.pdf
    • http://www.gorillawalker.com/beyond-disney-the-unofficial-guide-to-universal-orlando-seaworld-the.pdf
    • http://www.gorillawalker.com/nonlinear-dynamics-and-chaos-with-applications-to-physics-biology-chemistry.pdf
    • http://www.gorillawalker.com/comparative-study-of-marxist-economics-and-new-institutional-economics-chinese.pdf
    • http://www.gorillawalker.com/crossfire-philosophy-and-the-novel-in-spain-1900-1934-studies.pdf
    • http://www.gorillawalker.com/der-gro-e-r-tsel-mix-2-mit-ber-100.pdf
    • http://www.gorillawalker.com/deliver-us-from-evil-low-price-cd-defeating-terrorism-despotism.pdf
    • http://www.gorillawalker.com/calculating-curves-the-mathematics-hi
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.