Malicious PDF — malware analysis report

Static analysis result for SHA-256 da0a07ef53c22a06…

MALICIOUS

PDF

44.7 KB Created: 2019-02-14 08:26:01 +03:00 Authoring application: ABBYY FineReader 8.0 Professional Edition
MD5: 59d056becb1686884be32a0b491f0f4b SHA-1: 6056eefc2ede996dab56e42410a177ee53a7f45e SHA-256: da0a07ef53c22a0678cec6462375823f7354a7b0ab26f84384086564e85ad418
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a significant number of embedded external links, characteristic of a link farm or a distribution mechanism for further malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, with the first observed URL being http://www.gorillawalker.com/microwave-receivers-with-electronic-warfare-applications.pdf. While no scripts were extracted, the sheer volume of links suggests a malicious intent to redirect users to potentially harmful resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/microwave-receivers-with-electronic-warfare-applications.pdf
    • http://www.gorillawalker.com/ethical-health-care.pdf
    • http://www.gorillawalker.com/israeli-writers-consider-the-outsider.pdf
    • http://www.gorillawalker.com/te-pido-la-paz-cd.pdf
    • http://www.gorillawalker.com/perspectives-on-semantic-roles-typological-studies-in-language.pdf
    • http://www.gorillawalker.com/supergod-volume-1-tp.pdf
    • http://www.gorillawalker.com/a-house-in-the-sunflowers-sunflower-trilogy.pdf
    • http://www.gorillawalker.com/textbook-of-pistols-and-revolvers-their-ammunition-ballistics-and-use.pdf
    • http://www.gorillawalker.com/how-to-draw-animals-of-the-rain-forest-a-kid.pdf
    • http://www.gorillawalker.com/the-mating-challenge-werewolves-of-montana-book-5.pdf
    • http://www.gorillawalker.com/long-steel-rail-the-railroad-in-american-folksong-music-in.pdf
    • http://www.gorillawalker.com/spatial-statistics-for-remote-sensing-remote-sensing-and-digital-image.pdf
    • http://www.gorillawalker.com/the-complete-idiot-s-guide-to-project-management-5th-edition.pdf
    • http://www.gorillawalker.com/improving-software-development-productivity-effective-leadership-and-quantitative-methods-in.pdf
    • http://www.gorillawalker.com/hair-care-prevention-of-dandruff-baldness.pdf
    • http://www.gorillawalker.com/college-algebra-an-early-functions-approach-blitzer-algebra.pdf
    • http://www.gorillawalker.com/soundscapes-of-wellbeing-in-popular-music-geographies-of-health.pdf
    • http://www.gorillawalker.com/falla-seven-canciones-populares-espanolas-high-voice-pf-sp-f.pdf
    • http://www.gorillawalker.com/argentina-italian-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/algeria-a-country-profile.pdf
    • http://www.gorillawalker.com/sudden-and-disruptive-climate-change-exploring-the-real-risks-and.pdf
    • http://www.gorillawalker.com/mission-space.pdf
    • http://www.gorillawalker.com/bureau-of-reclamation-water-measurement-manual-pertaining-primarily-to-measurement.pdf
    • http://www.gorillawalker.com/the-president-s-devotional-the-daily-readings-that-inspired-president.pdf
    • http://www.gorillawalker.com/mini-music-guides-music-theory-essentials-everything-you-need-to.pdf
    • http://www.gorillawalker.com/no-mercy-a-darker-continuation.pdf
    • http://www.gorillawalker.com/galaxy-s5-the-missing-manual.pdf
    • http://www.gorillawalker.com/load-and-resistance-factor-design-of-steel-structures-prentice-hall.pdf
    • http://www.gorillawalker.com/practical-digital-design-using-i-c-s-electronic-technology.pdf
    • http://www.gorillawalker.com/in-the-nick-of-tyne.pdf
    • http://www.gorillawalker.com/vidas-de-los-doce-cesares-lives-of-the-twelve-caesars.pdf
    • http://www.gorillawalker.com/heterocyclic-chemistry-volume-ii-five-membered-heterocycles.pdf
    • http://www.gorillawalker.com/how-to-use-gopro-hero-3-cameras-the-adventure-sports.pdf
    • http://www.gorillawalker.com/literary-cultures-in-history-reconstructions-from-south-asia.pdf
    • http://www.gorillawalker.com/john-calvin.pdf
    • http://www.gorillawalker.com/inside-officescan-10-6-sp2.pdf
    • http://www.gorillawalker.com/exercices-orthographiques-mis-en-rapport-avec-la-grammaire-fran-aise.pdf
    • http://www.gorillawalker.com/tomorrow-land-apocalypse-later-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/encyclopedia-of-behavior-modification-and-cognitive-behavior-therapy-volume-i.pdf
    • http://www.gorillawalker.com/print-and-power-confucianism-communism-and-buddhism-in-the-making.pdf
    • http://www.gorillawalker.com/textbook-of-pistols-and-revolver
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.