Malicious PDF — malware analysis report

Static analysis result for SHA-256 d62272d703025948…

MALICIOUS

PDF

36.2 KB Created: 2020-01-17 19:20:51 +03:00 Authoring application: Adobe InDesign CS5 (7.0.4) (via Adobe PDF Library 9.9)
MD5: 40da6b251e132f690ed4ba424cdb211a SHA-1: b711553d3658c06f1f099fc9b83fb88cd0cef649 SHA-256: d62272d7030259488c5c8bcbef7a78f3b19f7eb5789c6535b5a2f97e1e1ba3a2
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged for containing a large number of external links, a technique often used for SEO manipulation or to distribute malicious content. The document body is heavily obfuscated and does not provide clear user-facing text, suggesting its primary purpose is not informational. The embedded URLs point to various PDF files hosted on the same domain, indicating a potential link farm or a distribution point for further malicious payloads.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/principles-and-practice-of-primary-care-sports-medicine.pdf
    • http://www.gorillawalker.com/curious-george-mad-libs-junior.pdf
    • http://www.gorillawalker.com/spirit-world.pdf
    • http://www.gorillawalker.com/short-guide-to-writing-about-film-a-7th-seventh-edition.pdf
    • http://www.gorillawalker.com/getting-them-sober-vol-4-separations-and-healings.pdf
    • http://www.gorillawalker.com/inside-the-atom.pdf
    • http://www.gorillawalker.com/the-big-book-of-american-trivia.pdf
    • http://www.gorillawalker.com/stones-laid-before-the-lord-a-history-of-monastic-architecture.pdf
    • http://www.gorillawalker.com/the-complete-superfoods-cookbook-dishes-and-drinks-for-energy-detoxing.pdf
    • http://www.gorillawalker.com/the-inhabitable-flesh-of-architecture-design-research-in-architecture.pdf
    • http://www.gorillawalker.com/handbook-of-molecular-physics-and-quantum-chemistry.pdf
    • http://www.gorillawalker.com/mmf-bisexual-romance-captured-by-the-lady-pirate-mmf-bisexual.pdf
    • http://www.gorillawalker.com/data-refinement-model-oriented-proof-methods-and-their-comparison-cambridge.pdf
    • http://www.gorillawalker.com/legitimate-work-at-home-jobs-companies-hiring-now-your-source.pdf
    • http://www.gorillawalker.com/henley-s-twentieth-century-forrmulas-recipes-and-processes-containing-ten.pdf
    • http://www.gorillawalker.com/pass-the-british-citizenship-test-teach-yourself-ebook-epub.pdf
    • http://www.gorillawalker.com/library-of-congress-classification-schedules-combined-with-additions-and-changes.pdf
    • http://www.gorillawalker.com/the-long-passage-centenary-fiction.pdf
    • http://www.gorillawalker.com/maxilire-mystere-dans-le-metro-bk-6-english-and-french.pdf
    • http://www.gorillawalker.com/eleanor-park-spanish-edition.pdf
    • http://www.gorillawalker.com/deceptive-darlings.pdf
    • http://www.gorillawalker.com/minecraft-handbooks-essential-beginners-guide-volume-2.pdf
    • http://www.gorillawalker.com/alive-alive-o.pdf
    • http://www.gorillawalker.com/puppetry-in-education-and-therapy-unlocking-doors-to-the-mind.pdf
    • http://www.gorillawalker.com/primal-blueprint-box-set-a-collection-of-five-hardcover-primal.pdf
    • http://www.gorillawalker.com/federal-courts-a-contemporary-approach-5th-interactive-casebook-series-english.pdf
    • http://www.gorillawalker.com/minitab-handbook-update-for-release-16.pdf
    • http://www.gorillawalker.com/miss-passport-city-guides-presents-a-3-day-unforgettable-mini.pdf
    • http://www.gorillawalker.com/warwick-the-man-behind-the-wars-of-the-roses-kindle.pdf
    • http://www.gorillawalker.com/galaxy-nexus-survival-guide-step-by-step-user-guide-for.pdf
    • http://www.gorillawalker.com/thinking-small-pays-big-polymer-nanocomposites-are-becoming-increasingly-popular.pdf
    • http://www.gorillawalker.com/a-chocolate-moose-for-dinner-turtleback-school-library-binding-edition.pdf
    • http://www.gorillawalker.com/sinister-dexter-kindle-edition.pdf
    • http://www.gorillawalker.com/the-stephen-king-value-collection-lawnmower-man-gray-matter-and.pdf
    • http://www.gorillawalker.com/gender-and-diversity-india-canada-and-beyond.pdf
    • http://www.gorillawalker.com/sparta-at-war-strategy-tactics-and-campaigns-950-362-bc.pdf
    • http://www.gorillawalker.com/simply-christmas-easy-dramas-speeches-and-recitations-for-children.pdf
    • http://www.gorillawalker.com/saving-money-in-nonprofit-organizations-more-than-100-money-saving.pdf
    • http://www.gorillawalker.com/economic-crisis-and-political-change-in-north-africa.pdf
    • http://www.gorillawalker.com/broth-the-year-is-1969-in-a-new-england-seaside.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.