Malicious PDF — malware analysis report

Static analysis result for SHA-256 d456e77ba8b77db8…

MALICIOUS

PDF

34.6 KB Created: 2020-01-03 22:20:55 +03:00 Authoring application: Adobe Acrobat 8.0 Combine Files (via Adobe Acrobat 8.0)
MD5: 8cc8e1f497d3f49def2176cf9e2be992 SHA-1: f8850b6e1fc65bf013488040ee9da161b5d33823 SHA-256: d456e77ba8b77db83d6c5ca4c964dc28db4815f86b2992e9b686d31cea99f864
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of embedded links to external websites, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm, likely intended for SEO manipulation or to direct users to potentially malicious content hosted on the linked domains. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8315

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/un-moving-four-ward.pdf
    • http://www.gorillawalker.com/the-civil-war-letters-of-william-a-robinson-and-the.pdf
    • http://www.gorillawalker.com/your-future-in-the-automotive-industry.pdf
    • http://www.gorillawalker.com/marlene-dietrich-the-songbook.pdf
    • http://www.gorillawalker.com/a-companion-to-shakespeare-s-works-the-poems-problem-comedies.pdf
    • http://www.gorillawalker.com/sifting-through-the-madness-for-the-word-the-line-the.pdf
    • http://www.gorillawalker.com/point-and-line-to-plane-dover-fine-art-history-of.pdf
    • http://www.gorillawalker.com/entwined-strangers-sorcery-shifters-book-4-kindle-edition.pdf
    • http://www.gorillawalker.com/afterlife-what-you-really-want-to-know-about-heaven-kindle.pdf
    • http://www.gorillawalker.com/control-your-blood-pressure-keeping-a-lid-on-hypertension-52.pdf
    • http://www.gorillawalker.com/supervisor-s-survival-kit-your-first-step-into-management-neteffect.pdf
    • http://www.gorillawalker.com/selected-sermons-prayers-and-devotions.pdf
    • http://www.gorillawalker.com/from-here-to-there-and-back-again-hardcover.pdf
    • http://www.gorillawalker.com/meetings-expositions-events-conventions-2nd-edition.pdf
    • http://www.gorillawalker.com/wenda-gu-at-dartmouth-the-art-of-installation.pdf
    • http://www.gorillawalker.com/simply-rich-life-and-lessons-from-the-cofounder-of-amway.pdf
    • http://www.gorillawalker.com/an-islamic-story-the-flight-from-makkah-hopscotch-religion.pdf
    • http://www.gorillawalker.com/m-business-communication-print-replica-kindle-edition.pdf
    • http://www.gorillawalker.com/combined-transport-for-time-sensitive-food-distribution-development-and-applications.pdf
    • http://www.gorillawalker.com/microsoft-office-project-server-2007-the-complete-reference.pdf
    • http://www.gorillawalker.com/london-a-souvenir-guide-in-english.pdf
    • http://www.gorillawalker.com/the-defense-of-the-napoleonic-kingdom-of-northern-italy-1813.pdf
    • http://www.gorillawalker.com/iec-60153-2-ed-2-0-b-1974-hollow-metallic.pdf
    • http://www.gorillawalker.com/step-milf-s-candlelight-sleepover.pdf
    • http://www.gorillawalker.com/the-evolution-of-man-a-popular-exposition-of-the-principal.pdf
    • http://www.gorillawalker.com/ethnography-for-education-doing-qualitative-research-in-educational-settings.pdf
    • http://www.gorillawalker.com/rapture-jesus-is-coming-dreams-visions-and-encounters.pdf
    • http://www.gorillawalker.com/a-speaker-s-guidebook-text-and-reference.pdf
    • http://www.gorillawalker.com/washington-state-fishing-guide-8th-edition.pdf
    • http://www.gorillawalker.com/los-minutos-negros-spanish-edition.pdf
    • http://www.gorillawalker.com/velluto-nero-la-genesi-italian-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/fulfilling-the-essence-the-handbook-of-traditional-contemporary-chinese-treatments.pdf
    • http://www.gorillawalker.com/mediterranean-diet-mediterranean-diet-guide-grocery-list-recipes-and-more.pdf
    • http://www.gorillawalker.com/violin-concerto-no-3-op-58-orchestra-score-parts-bassoon.pdf
    • http://www.gorillawalker.com/rider-haggard-collection-allan-quatermain-series-evergreen-kindle-edition.pdf
    • http://www.gorillawalker.com/import-practice-answer-book-2015.pdf
    • http://www.gorillawalker.com/out-of-the-mountains-the-coming-age-of-the-urban.pdf
    • http://www.gorillawalker.com/you-re-here-for-a-reason.pdf
    • http://www.gorillawalker.com/the-pdr-pocket-guide-to-prescription-drugs-second-edition-pdr.pdf
    • http://www.gorillawalker.com/a-first-course-in-probability.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.