Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5cad47d99c5da35…

MALICIOUS

PDF

43.3 KB Created: 2018-12-02 20:18:01 +03:00 Authoring application: Adobe InDesign CC (Macintosh) (via Adobe PDF Library 10.0.1)
MD5: 36ce7a0c9880854147e7c8d8f34a963c SHA-1: f3d91233a326099e4af5f081d1f414ee82893b6a SHA-256: d5cad47d99c5da35345c57d0a0edc18b28b7763d2636fd87854a44e473504750
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to drive traffic to numerous websites, potentially for SEO manipulation or to host malicious content. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/unix-interview-questions-you-ll-most-likely-be-asked.pdf
    • http://www.gorillawalker.com/debacles-at-bull-run-the-battles-of-first-manassas-and.pdf
    • http://www.gorillawalker.com/amerika-skildringer-natur-og-kulturliv-i-den-ny-verden-danish.pdf
    • http://www.gorillawalker.com/blood-and-iron-the-penrose-series-book-2-unabridged-audible.pdf
    • http://www.gorillawalker.com/adam-copeland-on-edge-wwe-kindle-edition.pdf
    • http://www.gorillawalker.com/2012-2021-the-dawn-of-the-sixth-sun-the-path.pdf
    • http://www.gorillawalker.com/god-bless-you-dr-kevorkian.pdf
    • http://www.gorillawalker.com/full-catastrophe-living.pdf
    • http://www.gorillawalker.com/runecaster-s-handbook-the-well-of-wyrd.pdf
    • http://www.gorillawalker.com/mayan-tales-from-zinacantan-dreams-and-stories-from-the-people.pdf
    • http://www.gorillawalker.com/learn-italian-bilingual-book-italian-english-the-life-of-cleopatra.pdf
    • http://www.gorillawalker.com/polyolefins-50-years-after-ziegler-and-natta-i-polyethylene-and.pdf
    • http://www.gorillawalker.com/carl-aubock-the-workshop.pdf
    • http://www.gorillawalker.com/the-physiological-enigma-of-woman-the-mystery-of-menstruation-spiral.pdf
    • http://www.gorillawalker.com/un-colchon-de-plumas-para-agata-un-cuento-de-alas.pdf
    • http://www.gorillawalker.com/theresienstadt-hitler-s-gift-to-the-jews.pdf
    • http://www.gorillawalker.com/transforming-the-u-s-financial-system-equity-and-efficiency-for.pdf
    • http://www.gorillawalker.com/rorschachiana-vol-35-journal-of-the-international-society-for-the.pdf
    • http://www.gorillawalker.com/e-mini-futures-trading-your-complete-step-by-step-guide.pdf
    • http://www.gorillawalker.com/macroeconomic-policy-in-the-european-monetary-union-from-the-old.pdf
    • http://www.gorillawalker.com/fukushima-the-story-of-a-nuclear-disaster-kindle-edition.pdf
    • http://www.gorillawalker.com/saudi-arabia-labor-law-outline.pdf
    • http://www.gorillawalker.com/the-apocrypha-king-james-version.pdf
    • http://www.gorillawalker.com/wild-birds-of-california.pdf
    • http://www.gorillawalker.com/teoria-del-complotto-il-nuovo-ordine-mondiale-limited-edition-italian.pdf
    • http://www.gorillawalker.com/feast-food-that-celebrates-life-nigella-collection.pdf
    • http://www.gorillawalker.com/gymnastics-scorebook-journal-rhythmic-edition-dream-believe-achieve-athletics.pdf
    • http://www.gorillawalker.com/adaptive-processing-of-brain-signals.pdf
    • http://www.gorillawalker.com/mandate-madness-how-congress-forces-states-and-localities-to-do.pdf
    • http://www.gorillawalker.com/approximation-and-complexity-in-numerical-optimization-continuous-and-discrete-problems.pdf
    • http://www.gorillawalker.com/concerto-for-horn-in-e-flat-k-417-donald-hunsberger.pdf
    • http://www.gorillawalker.com/the-irish-peacock-the-confessions-of-a-legendary-talent-agent.pdf
    • http://www.gorillawalker.com/the-india-connection-actions-and-insights-middle-east-north-africa.pdf
    • http://www.gorillawalker.com/anhelo-salvaje-i-spanish-edition.pdf
    • http://www.gorillawalker.com/heavy-metal-magazine-sept-1982-vol-vi-no-6.pdf
    • http://www.gorillawalker.com/better-spelling-in-5-minutes-a-day-fun-spelling-activities.pdf
    • http://www.gorillawalker.com/one-recipe-plum-puree-kindle-edition.pdf
    • http://www.gorillawalker.com/concerto-no-3-k447-f-horn-solo-with-piano-accompaniment.pdf
    • http://www.gorillawalker.com/99-best-closed-end-funds-to-own-now.pdf
    • http://www.gorillawalker.com/die-puma-story.pdf
    • http://www.gorillawalker.com/runecaster-s-handbook-the-well-of-wy
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.