Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7106c13940b2732…

MALICIOUS

PDF

40.7 KB Created: 2019-03-17 11:02:50 +03:00 Authoring application: Acrobat PDFMaker 11 for Word (via Adobe PDF Library 11.0)
MD5: 7c3ccd8c48b43c3abfe68305d351287e SHA-1: e97695516ba606f3df721c1745cd1e29905c2429 SHA-256: d7106c13940b2732494f80ae7007b75688a94f12f1656e7883b51d86584219ee
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, many of which point to PDF files on the same domain. This suggests a link farm or a method to distribute further malicious content. The primary attack pattern involves luring the user to click on these links, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/performance-fuel-injection-systems-hp1557-how-to-design-build-modify.pdf
    • http://www.gorillawalker.com/roots-of-strategy-book-2.pdf
    • http://www.gorillawalker.com/muerte-en-una-estrella-shooting-star-spanish-edition.pdf
    • http://www.gorillawalker.com/getting-started-in-real-estate-day-trading-proven-techniques-for.pdf
    • http://www.gorillawalker.com/first-principles-the-jurisprudence-of-clarence-thomas.pdf
    • http://www.gorillawalker.com/nuclear-astrophysics-lecture-notes-in-physics.pdf
    • http://www.gorillawalker.com/fair-stood-the-wind-for-france.pdf
    • http://www.gorillawalker.com/cases-in-bioethics-selections-from-the-hastings-center-report.pdf
    • http://www.gorillawalker.com/exploring-international-human-rights-essential-readings-critical-connections-studies-in.pdf
    • http://www.gorillawalker.com/options-trading-strategies-simple-options-trading-formulas-for-successful-options.pdf
    • http://www.gorillawalker.com/silicon-valley-women-and-the-california-dream-gender-class-and.pdf
    • http://www.gorillawalker.com/knavery-ripple-series-book-6-kindle-edition.pdf
    • http://www.gorillawalker.com/ketogenic-diet-a-14-day-ketogenic-diet-plan-for-a.pdf
    • http://www.gorillawalker.com/implementing-for-results-your-strategic-plan-in-action-pla-results.pdf
    • http://www.gorillawalker.com/soviet-union-black-sea-approaches-to-sevastopol-sudoc-d-5.pdf
    • http://www.gorillawalker.com/oatmeal-cookbook-over-460-oatmeal-recipes-oatmeal-cookbook-oatmeal-recipes.pdf
    • http://www.gorillawalker.com/flashman-and-the-war-between-the-states.pdf
    • http://www.gorillawalker.com/the-book-of-regency-accessory-the-books-of-scions.pdf
    • http://www.gorillawalker.com/sacrifice-forever-series-book-10.pdf
    • http://www.gorillawalker.com/rules-for-radical-conservatives-beating-the-left-at-its-own.pdf
    • http://www.gorillawalker.com/wheat-free-classics-lunch-and-raw-food-recipes.pdf
    • http://www.gorillawalker.com/karen-brown-s-german-country-inns-itineraries-4th-fourth-edition.pdf
    • http://www.gorillawalker.com/experiments-in-fluid-mechanics.pdf
    • http://www.gorillawalker.com/fade-to-blue.pdf
    • http://www.gorillawalker.com/sherman-s-civil-war-selected-correspondence-of-william-t-sherman.pdf
    • http://www.gorillawalker.com/tutu-tales-night-of-the-nutcracker-volume-1.pdf
    • http://www.gorillawalker.com/introduction-to-imaging-spectrometers-tutorial-texts-in-optical-engineering.pdf
    • http://www.gorillawalker.com/everyday-life-in-renaissance-times-uncovering-history.pdf
    • http://www.gorillawalker.com/the-ghost-of-graylock-a-hauntings-novel.pdf
    • http://www.gorillawalker.com/play-it-again.pdf
    • http://www.gorillawalker.com/pacific-century-the-emergence-of-modern-pacific-asia.pdf
    • http://www.gorillawalker.com/2007-edition-pdr-nurse-s-drug-handbook.pdf
    • http://www.gorillawalker.com/a-6-cd-set-to-accompany-listen-brief.pdf
    • http://www.gorillawalker.com/single-mom-vs-bad-dad-the-u-s-family-court.pdf
    • http://www.gorillawalker.com/chasing-lacie-sea-island-wolves-4-the-jenny-penn-collection.pdf
    • http://www.gorillawalker.com/criminal-evidence-principles-cases-6th-ed.pdf
    • http://www.gorillawalker.com/biblia-sacra-utriusque-testamenti-clingunis-primaeris-explicata-romanian-edition.pdf
    • http://www.gorillawalker.com/jewish-history-according-to-josephus-kindle-edition.pdf
    • http://www.gorillawalker.com/risk-management-handbook-for-health-care-organizations-3-volume-set.pdf
    • http://www.gorillawalker.com/new-zealand-soil-classification.pdf
    • http://www.gorillawalker.com/exploring-international-human-rights-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.