Malicious PDF — malware analysis report

Static analysis result for SHA-256 df4727566a3b43df…

MALICIOUS

PDF

43.0 KB Created: 2018-11-15 08:05:00 +03:00 Authoring application: CorelDRAW X5 (via Corel PDF Engine Version 15.0.0.486)
MD5: 67cd4cfda8ca6c46358ac70685c2b51f SHA-1: 9ea57e6c1dabfc0251832d9779e3a0ff116e49e2 SHA-256: df4727566a3b43dfbc97591b6c6b4fbe81946871ca152da9533ce27501b7bc94
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by an ML classifier as malicious and contains a large number of external links, indicating a potential SEO link farm or a distribution mechanism for further malicious content. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a coordinated effort to spread content or manipulate search rankings. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/das-herzensgebet-die-f-lle-des-lebens-entdecken-german-edition.pdf
    • http://www.gorillawalker.com/mules-and-men-p-s.pdf
    • http://www.gorillawalker.com/creative-coastal-cooking.pdf
    • http://www.gorillawalker.com/the-rake-just-for-your-pleasure.pdf
    • http://www.gorillawalker.com/imago-mundi-mvndi-27-twenty-seven-second-series-volume-i.pdf
    • http://www.gorillawalker.com/deep-brain-stimulation-programming-principles-and-practice.pdf
    • http://www.gorillawalker.com/exercises-to-accompany-the-essentials-of-english-a-writer-s.pdf
    • http://www.gorillawalker.com/the-dorsai-man-the-star-road.pdf
    • http://www.gorillawalker.com/lord-melchior-kindle-edition.pdf
    • http://www.gorillawalker.com/field-manual-fm-3-34-343-fm-5-446-military.pdf
    • http://www.gorillawalker.com/to-the-actor.pdf
    • http://www.gorillawalker.com/peppa-pig-the-official-annual-2015.pdf
    • http://www.gorillawalker.com/mars-greenhouses-concepts-and-challenges-proceedings-from-a-1999-workshop.pdf
    • http://www.gorillawalker.com/crime-and-detective-fiction-critical-insights.pdf
    • http://www.gorillawalker.com/saxon-phonics-spelling-2-fluency-reader-set.pdf
    • http://www.gorillawalker.com/martha-graham-a-dancer-s-life.pdf
    • http://www.gorillawalker.com/when-you-lie-about-your-age-the-terrorists-win-reflections.pdf
    • http://www.gorillawalker.com/david-balfour.pdf
    • http://www.gorillawalker.com/tibetan-furniture.pdf
    • http://www.gorillawalker.com/the-phase-three-fulcrum-building-high-leverage-organizations-using-the.pdf
    • http://www.gorillawalker.com/aids-inc.pdf
    • http://www.gorillawalker.com/st-john-chrysostom-homilies-on-the-old-testament-homilies-on.pdf
    • http://www.gorillawalker.com/best-sermons-ever-compact-edition.pdf
    • http://www.gorillawalker.com/the-pickwick-papers-english-library.pdf
    • http://www.gorillawalker.com/the-asperger-couple-s-workbook-practical-advice-and-activities-for.pdf
    • http://www.gorillawalker.com/the-germans-we-trusted-stories-which-had-to-be-told.pdf
    • http://www.gorillawalker.com/perfection-coming-to-terms-with-being-human.pdf
    • http://www.gorillawalker.com/the-suppressed-sister-a-relationship-in-novels-by-nineteenth-and.pdf
    • http://www.gorillawalker.com/shanghai-mini-map.pdf
    • http://www.gorillawalker.com/the-solitudes-book-one-of-the-aegypt-cycle.pdf
    • http://www.gorillawalker.com/the-parson-s-pocket-book-loose-leaf-diary-2013.pdf
    • http://www.gorillawalker.com/drinking-wine-a-complete-guide-for-the-buyer-consumer-macdonald.pdf
    • http://www.gorillawalker.com/britannia-s-issue-the-rise-of-british-literature-from-dryden.pdf
    • http://www.gorillawalker.com/frank-sinatra-anthology-volume-2.pdf
    • http://www.gorillawalker.com/woelfel-s-dental-anatomy-its-relevance-to-dentistry-7th-seventh.pdf
    • http://www.gorillawalker.com/plato-s-ethics.pdf
    • http://www.gorillawalker.com/international-judicial-integration-and-fragmentation-international-courts-and-tribunals-series.pdf
    • http://www.gorillawalker.com/studi-lovecraftiani-n-13-italian-edition.pdf
    • http://www.gorillawalker.com/the-conservation-movement-a-history-of-architectural-preservation-antiquity-to.pdf
    • http://www.gorillawalker.com/drama-high-frenemies.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.