Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1e7840dbd88b24f…

MALICIOUS

PDF

42.6 KB Created: 2019-03-17 08:23:17 +03:00 Authoring application: Adobe InDesign CS4_J (6.0.5) (via Acrobat Distiller 7.0 (Windows)) First seen: 2020-01-07
MD5: 2c2ac6dde57504daf1d7211327969367 SHA-1: b40f7b8897c493947b622fc311f2155e30a534cf SHA-256: d1e7840dbd88b24fafecab73ad83058aeaafc855f7902f5305125655359c81dd
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a critical heuristic for containing a large number of external links, forming a link farm. The ML classifier also indicated a high probability of maliciousness. The document body was unreadable, but the presence of numerous links suggests a social engineering attempt to drive traffic to potentially malicious or deceptive content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/developmental-coordination-disorder-and-its-consequences.pdf
    • http://www.gorillawalker.com/pimsleur-italian-level-5-cd-learn-to-speak-and-understand.pdf
    • http://www.gorillawalker.com/elephants-amazing-animals-weigl.pdf
    • http://www.gorillawalker.com/the-princess-coloring-book.pdf
    • http://www.gorillawalker.com/the-rule-of-law.pdf
    • http://www.gorillawalker.com/miniaturized-systems-with-micro-optics-and-micromechanics-iii-26-27.pdf
    • http://www.gorillawalker.com/case-files-emergency-medicine-third-edition-lange-case-files.pdf
    • http://www.gorillawalker.com/how-the-summer-season-came-and-other-assiniboine-indian-stories.pdf
    • http://www.gorillawalker.com/death-decay-and-reconstruction-approaches-to-archaeology-and-forensic-science.pdf
    • http://www.gorillawalker.com/sonatas-op-38-73-kalmus-edition.pdf
    • http://www.gorillawalker.com/school-choice-and-competition-markets-in-the-public-interest-educational.pdf
    • http://www.gorillawalker.com/plenty-fish.pdf
    • http://www.gorillawalker.com/the-survivors-club.pdf
    • http://www.gorillawalker.com/camping-and-woodcraft-a-handbook-for-vacation-campers-and-for.pdf
    • http://www.gorillawalker.com/eglr-2012-set.pdf
    • http://www.gorillawalker.com/thank-you-mama.pdf
    • http://www.gorillawalker.com/evidence-law-adrift.pdf
    • http://www.gorillawalker.com/the-light-tales-from-a-revolution-new-jersey-kindle-edition.pdf
    • http://www.gorillawalker.com/el-salvador-today-kindle-edition.pdf
    • http://www.gorillawalker.com/developmental-anatomy.pdf
    • http://www.gorillawalker.com/hit-and-run-trading-ii-capturando-movimientos-explosivos-a-corto.pdf
    • http://www.gorillawalker.com/the-autoimmune-paleo-cookbook-action-plan-a-practical-guide-to.pdf
    • http://www.gorillawalker.com/let-s-communicate-a-guide-to-improve-speech-and-swallowing.pdf
    • http://www.gorillawalker.com/the-baby-bistro-cookbook-healthy-delicious-cuisine-for-babies-toddlers.pdf
    • http://www.gorillawalker.com/angry-birds-2015-mini-7-x-7-calendar.pdf
    • http://www.gorillawalker.com/career-theory-and-practice-learning-through-case-studies-1st-first.pdf
    • http://www.gorillawalker.com/death-of-wcw-the-kindle-edition.pdf
    • http://www.gorillawalker.com/the-telling-seasons-of-grace-book-3-paperback.pdf
    • http://www.gorillawalker.com/a-good-deal-or-almost-antique.pdf
    • http://www.gorillawalker.com/match-a-systematic-sane-process-for-hiring-the-right-person.pdf
    • http://www.gorillawalker.com/gmp-the-state-ballet-school-in-berlin.pdf
    • http://www.gorillawalker.com/kindergarten-journal.pdf
    • http://www.gorillawalker.com/citroen-cx-2000-2200-2400-2500-cx25-gt-gti-gti.pdf
    • http://www.gorillawalker.com/the-original-365-jokes-puns-and-riddles-calendar-2003.pdf
    • http://www.gorillawalker.com/quantum-mechanics-for-pedestrians-1-fundamentals-undergraduate-lecture-notes-in.pdf
    • http://www.gorillawalker.com/the-discernment-of-spirits-an-ignatian-guide-for-everyday-living.pdf
    • http://www.gorillawalker.com/nonprofit-management-principles-and-practice.pdf
    • http://www.gorillawalker.com/mascaras.pdf
    • http://www.gorillawalker.com/fire-games-pyforial-mage-trilogy-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/keeping-good-time-reflections-on-knowledge-power-and-people.pdf
    • http://www.gorillawalker.com/death-decay-and-reconstruction-approac
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.