Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5b866a3af868f52…

MALICIOUS

PDF

41.8 KB Created: 2018-11-14 08:46:01 +03:00 Authoring application: FrameMaker 7.1 (via Acrobat Distiller 7.0.5 (Windows))
MD5: 08e739956e1d00f43e69f68a83a983d6 SHA-1: 12e291bb048b0159083d0ea4e8666d6380e7d7bb SHA-256: d5b866a3af868f52311bb457257b5dceeb1e150db15f2a4e5e583ec56c0fca13
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a website hosting numerous PDF documents, potentially for SEO manipulation or to serve as a distribution point for other malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/my-big-mouth-10-songs-i-wrote-that-almost-got.pdf
    • http://www.gorillawalker.com/self-sufficient-how-to-take-good-care-of-yourself-and.pdf
    • http://www.gorillawalker.com/contra-todo-enemigo-spanish-edition.pdf
    • http://www.gorillawalker.com/the-farm-on-the-river-of-emeralds-vintage-departures.pdf
    • http://www.gorillawalker.com/summer-splash-travel-activity-book-grade-3.pdf
    • http://www.gorillawalker.com/a-skeptic-s-guide-to-the-12-steps.pdf
    • http://www.gorillawalker.com/walking-among-us-the-alien-plan-to-control-humanity.pdf
    • http://www.gorillawalker.com/aurelian-emperor-of-rome-a-tale-of-the-roman-empire.pdf
    • http://www.gorillawalker.com/olympic-sports-and-propaganda-games-moscow-1980.pdf
    • http://www.gorillawalker.com/these-hamptons.pdf
    • http://www.gorillawalker.com/mysterious-lands-and-peoples-mysteries-of-the-unknown.pdf
    • http://www.gorillawalker.com/school-of-udhra-paperback.pdf
    • http://www.gorillawalker.com/programming-language-concepts.pdf
    • http://www.gorillawalker.com/man-of-steel-superman-s-superpowers-i-can-read-book.pdf
    • http://www.gorillawalker.com/time-in-a-bottle-mastering-the-experience-of-life.pdf
    • http://www.gorillawalker.com/family-and-the-state-considerations-for-social-policy.pdf
    • http://www.gorillawalker.com/sting-in-the-tail-kindle-edition.pdf
    • http://www.gorillawalker.com/hacer-que-su-las-galletas-y-pasteles-en-el-hogar.pdf
    • http://www.gorillawalker.com/tatuajes-del-alma-poemas-de-amor-spanish-edition.pdf
    • http://www.gorillawalker.com/financial-accounting-reporting-and-analysis.pdf
    • http://www.gorillawalker.com/one-piece-vol-57.pdf
    • http://www.gorillawalker.com/coaching-perspectives-iii.pdf
    • http://www.gorillawalker.com/cognitive-behavioral-therapy.pdf
    • http://www.gorillawalker.com/mold-illness-and-mold-remediation-made-simple-discount-black-white.pdf
    • http://www.gorillawalker.com/netiquette-internet-etiquette-in-the-age-of-the-blog.pdf
    • http://www.gorillawalker.com/wrath-fire-and-steel-motorcycle-club-romance-fire-and-steel.pdf
    • http://www.gorillawalker.com/garland-of-mahamudra-practices.pdf
    • http://www.gorillawalker.com/how-rabbit-got-his-ears-a-mayan-indian-story.pdf
    • http://www.gorillawalker.com/also-hat-gott-die-welt-geliebt-bwv-68-full-score.pdf
    • http://www.gorillawalker.com/spine-tingling-magic-tricks.pdf
    • http://www.gorillawalker.com/sherpa-of-khumbu-people-livestock-and-landscape-studies-in-social.pdf
    • http://www.gorillawalker.com/plotto-the-master-book-of-all-plots.pdf
    • http://www.gorillawalker.com/more-trios-for-flutes-john-cacavas-trio-series.pdf
    • http://www.gorillawalker.com/elementary-differential-equations-with-boundary-value-problems-6th-edition.pdf
    • http://www.gorillawalker.com/johannesburg-south-africa-including-its-history-the-apartheid-museum-the.pdf
    • http://www.gorillawalker.com/critics-of-capitalism-victorian-reactions-to-political-economy-cambridge-english.pdf
    • http://www.gorillawalker.com/knights-adventurous-expanding-the-world-of-pendragon.pdf
    • http://www.gorillawalker.com/the-rise-of-renegade-x.pdf
    • http://www.gorillawalker.com/the-watercolorist-s-essential-notebook-landscapes.pdf
    • http://www.gorillawalker.com/usaf-and-vnaf-a-1-skyraider-units-of-the-vietnam.pdf
    • http://www.gorillawalker.com/a-skeptic-s-guid
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.