Malicious PDF — malware analysis report

Static analysis result for SHA-256 deb745ef5ee7ce45…

MALICIOUS

PDF

34.0 KB Created: 2019-09-18 21:39:17 +03:00 Authoring application: LaTeX with hyperref package (via xdvipdfmx (0.7.8))
MD5: cef04568e5ce213aaa73813d3f7b46da SHA-1: 935e6814d358490021bf8fffeb379b16ffb9e2d7 SHA-256: deb745ef5ee7ce45162fd955c88a3917d5a158c6e26845fbcb2c3302d546b4d3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged for containing a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier also indicated a high probability of maliciousness. No scripts were extracted, and the document body was unreadable, limiting further analysis.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8313

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/global-strategy-creating-and-sustaining-advantage-across-borders-strategic-management.pdf
    • http://www.gorillawalker.com/heart-sounds-a-cardiac-auscultation-primer.pdf
    • http://www.gorillawalker.com/social-skills-training-for-children-with-asperger-syndrome-and-high.pdf
    • http://www.gorillawalker.com/butter-on-the-bacon-a-modern-comedy-in-three-acts.pdf
    • http://www.gorillawalker.com/manual-of-acidic-emission-abatement-technologies-mobile-sources-v-4.pdf
    • http://www.gorillawalker.com/james-braid-champion-golfer.pdf
    • http://www.gorillawalker.com/the-one-armed-bandit-a-lucky-luke-adventure.pdf
    • http://www.gorillawalker.com/what-makes-a-flower-grow-usborne-starting-point-science.pdf
    • http://www.gorillawalker.com/the-soviet-image-a-hundred-years-of-photographs-from-inside.pdf
    • http://www.gorillawalker.com/get-free-cash-for-college-secrets-to-winning-scholarships.pdf
    • http://www.gorillawalker.com/childcraft-the-how-and-why-library-15-volumes.pdf
    • http://www.gorillawalker.com/hegels-concept-of-god-suny-series-in-hegelian-studies.pdf
    • http://www.gorillawalker.com/early-netherlandish-painting-from-rogier-van-der-weyden-to-gerard.pdf
    • http://www.gorillawalker.com/my-golden-christmas-book.pdf
    • http://www.gorillawalker.com/forensic-ballistics-styles-of-projectiles-crime-scene-investigation.pdf
    • http://www.gorillawalker.com/i-think-my-teacher-s-a-psychopath-kindle-edition.pdf
    • http://www.gorillawalker.com/historia-de-los-gobernantes-del-paraguay-1535-1887-paperback.pdf
    • http://www.gorillawalker.com/tiger-s-choice-silver-bullet-3-siren-publishing-classic-manlove.pdf
    • http://www.gorillawalker.com/the-best-unofficial-practice-tests-for-the-middle-level-isee.pdf
    • http://www.gorillawalker.com/who-was-saint-veronica-kindle-edition.pdf
    • http://www.gorillawalker.com/final-cut-express-4-editing-workshop.pdf
    • http://www.gorillawalker.com/the-sixth-extinction-journeys-among-the-lost-and-left-behind.pdf
    • http://www.gorillawalker.com/modernism-in-dispute-art-since-the-forties-modern-art-practices.pdf
    • http://www.gorillawalker.com/reflections-at-first-light-gift-book-lessons-and-stories-from.pdf
    • http://www.gorillawalker.com/kyoto-quizzes-800-japanese-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/combinatorial-theory.pdf
    • http://www.gorillawalker.com/bitter-love-blood-lines-5.pdf
    • http://www.gorillawalker.com/insight-flexi-map-barbados-insight-flexi-maps.pdf
    • http://www.gorillawalker.com/magyarland-being-the-narrative-of-our-travels-through-the-highlands.pdf
    • http://www.gorillawalker.com/dream-city-race-power-and-the-decline-of-washington-d.pdf
    • http://www.gorillawalker.com/between-ideology-and-realpolitik-woodrow-wilson-and-the-russian-revolution.pdf
    • http://www.gorillawalker.com/don-t-ever-quit.pdf
    • http://www.gorillawalker.com/precalculus-for-christian-schools.pdf
    • http://www.gorillawalker.com/insight-guides-mexico-city.pdf
    • http://www.gorillawalker.com/crafting-prehispanic-maya-kinship.pdf
    • http://www.gorillawalker.com/sabor-a-tentaci-n-taste-of-temptation-harlequin-desco-spanish.pdf
    • http://www.gorillawalker.com/women-and-borderline-personality-disorder-symptoms-and-stories-paperback-2000.pdf
    • http://www.gorillawalker.com/the-model-shop-complete-collection-of-short-stories-by-raymond.pdf
    • http://www.gorillawalker.com/the-art-of-staying-neutral-the-netherlands-in-the-first.pdf
    • http://www.gorillawalker.com/essentials-of-corporation-law.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.