Malicious PDF — malware analysis report

Static analysis result for SHA-256 d96bd09d45366a15…

MALICIOUS

PDF

42.4 KB Created: 2019-02-13 22:34:29 +03:00 Authoring application: Acrobat PDFMaker 7.0 for Excel (via Acrobat Distiller 7.0 (Windows))
MD5: a2fa835fc5521351fb157d116969838a SHA-1: 6ef35d42d511ceee74aca7926d2cc46674e15283 SHA-256: d96bd09d45366a154ab1cff450585b5857129cb999228c2c11953f77d716c324
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. The embedded URLs all point to the same domain, suggesting a coordinated effort to distribute content or manipulate search engine results. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/themes-of-contemporary-art-visual-art-after-1980.pdf
    • http://www.gorillawalker.com/danube-bike-trail-hungary-croatia-serbia-romania-from-budapest-to.pdf
    • http://www.gorillawalker.com/tropical-gardens-of-the-philippines.pdf
    • http://www.gorillawalker.com/music-express-the-rise-fall-resurrection-of-canada-s-music.pdf
    • http://www.gorillawalker.com/os-2-warp-beats-windows-4-0-to-market-ibm.pdf
    • http://www.gorillawalker.com/the-heart-s-ashes.pdf
    • http://www.gorillawalker.com/the-outlaw-years-the-history-of-the-land-pirates-of.pdf
    • http://www.gorillawalker.com/i-came-i-stayed-the-true-story-of-my-life.pdf
    • http://www.gorillawalker.com/old-norse-images-of-women-middle-ages.pdf
    • http://www.gorillawalker.com/truth-fantasy-and-paradox-the-fairy-tales-of-george-macdonald.pdf
    • http://www.gorillawalker.com/bangkok-bangkok-history-and-highlights-of-the-city-of-angels.pdf
    • http://www.gorillawalker.com/all-we-did-was-fly-to-the-moon-history-alive.pdf
    • http://www.gorillawalker.com/hillbillies-downlow-filthy-straight-alpha-male-rednecks-go-downlow-on.pdf
    • http://www.gorillawalker.com/catalogue-of-primates-in-the-british-museum-natural-history-and.pdf
    • http://www.gorillawalker.com/22-d-as-contigo-esp-ritu-santo-spanish-edition.pdf
    • http://www.gorillawalker.com/wildlife-watcher-s-handbook.pdf
    • http://www.gorillawalker.com/the-silence-of-the-wave.pdf
    • http://www.gorillawalker.com/bombay-place-names-and-street-names-an-excursion-into-the.pdf
    • http://www.gorillawalker.com/discovering-timber-framed-buildings-shire-discovering.pdf
    • http://www.gorillawalker.com/la-recepci-n-de-la-cultura-extranjera-en-la-ilustraci.pdf
    • http://www.gorillawalker.com/engineering-design-graphics-11th-edition-by-earle-james-h-prentice.pdf
    • http://www.gorillawalker.com/behave-yourself-the-working-guide-to-business-etiquette.pdf
    • http://www.gorillawalker.com/mountaineering-the-freedom-of-the-hills.pdf
    • http://www.gorillawalker.com/calligraphy-the-art-of-written-forms.pdf
    • http://www.gorillawalker.com/aghora-iii-the-law-of-karma.pdf
    • http://www.gorillawalker.com/iec-60269-4-ed-3-0-b-1986-low-voltage.pdf
    • http://www.gorillawalker.com/nickers-constable-crime.pdf
    • http://www.gorillawalker.com/the-last-unicorn-third-book-in-the-dragon-keepers-series.pdf
    • http://www.gorillawalker.com/by-don-lessem-dinosaurs-to-dodos-an-encyclopedia-of-extinct.pdf
    • http://www.gorillawalker.com/the-runner-the-tillerman-cycle-book-4-kindle-edition.pdf
    • http://www.gorillawalker.com/above-all-don-t-look-back-caraf-books-caribbean-and.pdf
    • http://www.gorillawalker.com/the-wrong-apple.pdf
    • http://www.gorillawalker.com/the-syntax-of-spoken-arabic-a-comparative-study-of-moroccan.pdf
    • http://www.gorillawalker.com/puntos-de-partida-an-invitation-to-spanish-english-and-spanish.pdf
    • http://www.gorillawalker.com/cheng-tsui-english-chinese-lexicon-of-business-terms-with-pinyin.pdf
    • http://www.gorillawalker.com/construction-planning-and-scheduling-3rd-edition.pdf
    • http://www.gorillawalker.com/fish-happens-words-of-wisdom-from-the-penguins-the-penguins.pdf
    • http://www.gorillawalker.com/klezmer-fiddle-tunes-33-pieces-schott-world-music.pdf
    • http://www.gorillawalker.com/reed-s-reckoning-kindle-edition.pdf
    • http://www.gorillawalker.com/our-baby-abraham-the-story-of-abraham-s-first-year.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.