Malicious PDF — malware analysis report

Static analysis result for SHA-256 df8a45c7ce7b8540…

MALICIOUS

PDF

46.3 KB Created: 2018-12-15 20:18:20 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 8.0.0 (Windows))
MD5: 240d199da5061f7616eee5ed3ad33795 SHA-1: 3844eca7d1220daacdb563c8b6b1c1b95db6bbd9 SHA-256: df8a45c7ce7b854027b2bb084129e7225f2f7326dbdecc03b1035f1c775aeb0b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The document body is heavily obfuscated and unreadable, preventing a deeper analysis of its specific intent beyond the link farm. The primary attack pattern observed is the distribution of a large number of links, likely to manipulate search engine results or to serve as a distribution point for other malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/construindo-sistemas-de-telefonia-com-o-asterisk-spanish-edition.pdf
    • http://www.gorillawalker.com/following-the-cultured-public-s-chosen-one-why-martensen-mattered.pdf
    • http://www.gorillawalker.com/the-hospital-autopsy-a-manual-of-fundamental-autopsy-practice-third.pdf
    • http://www.gorillawalker.com/differential-equations-for-engineers-and-scientists.pdf
    • http://www.gorillawalker.com/winning-is-everything.pdf
    • http://www.gorillawalker.com/inbetween-kissed-by-death.pdf
    • http://www.gorillawalker.com/meet-eve-bunting-about-the-author.pdf
    • http://www.gorillawalker.com/bikers-baby-bbw-motorcycle-pregnancy-romance.pdf
    • http://www.gorillawalker.com/pearson-algebra-1-common-core-vol-1-teacher-s-edition.pdf
    • http://www.gorillawalker.com/torts-summary-for-law-schools-negligence-intentional-torts-strict-liability.pdf
    • http://www.gorillawalker.com/texas-advance-sheet-may-2012-kindle-edition.pdf
    • http://www.gorillawalker.com/x-rated-menage-erotica-ffm.pdf
    • http://www.gorillawalker.com/her-plaything.pdf
    • http://www.gorillawalker.com/elementary-matrix-theory-dover-books-on-mathematics.pdf
    • http://www.gorillawalker.com/how-to-start-a-profitable-worm-business-on-a-shoestring.pdf
    • http://www.gorillawalker.com/mafalda-y-las-frases-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/modern-crisis.pdf
    • http://www.gorillawalker.com/quakes-eruptions-and-other-geologic-cataclysms-revised-edition-revealing-the.pdf
    • http://www.gorillawalker.com/the-idea-of-reform-its-impact-on-christian-thought-and.pdf
    • http://www.gorillawalker.com/distrofias-y-degeneraciones-corneales-corneal-dystophies-and-degenerations-spanish-edition.pdf
    • http://www.gorillawalker.com/camerimage-2004-international-film-festival-of-the-art-of-cinematography.pdf
    • http://www.gorillawalker.com/waiting-for-an-army-to-die-the-tragedy-of-agent.pdf
    • http://www.gorillawalker.com/the-gift-of-breath.pdf
    • http://www.gorillawalker.com/the-future-of-higher-education-perspectives-from-america-s-academic.pdf
    • http://www.gorillawalker.com/state-map-miami-metro-beach-25.pdf
    • http://www.gorillawalker.com/national-geographic-kids-125-true-stories-of-amazing-pets-inspiring.pdf
    • http://www.gorillawalker.com/fluvial-processes-in-geomorphology-dover-earth-science-paperback-1995-author.pdf
    • http://www.gorillawalker.com/the-secret-of-the-ninth-planet-bengali-edition.pdf
    • http://www.gorillawalker.com/sex-the-supreme-court-obscenity-and-indecency-laws-in-canada.pdf
    • http://www.gorillawalker.com/grant-green-rediscovering-the-forgotten-genuis-of-jazz-guitar.pdf
    • http://www.gorillawalker.com/who-grows-up-in-the-forest-a-book-about-forest.pdf
    • http://www.gorillawalker.com/the-apocrypha-in-the-irish-church-manuscript-studies-guides.pdf
    • http://www.gorillawalker.com/raising-and-educating-a-deaf-child-a-comprehensive-guide-to.pdf
    • http://www.gorillawalker.com/kinnie-wagner-the-complete-kinnie-wagner-story-reprinted-from-pug.pdf
    • http://www.gorillawalker.com/forecasting-for-profit-a-technique-for-business-management.pdf
    • http://www.gorillawalker.com/weapons-of-mass-destruction-writing-the-critical-essay.pdf
    • http://www.gorillawalker.com/f-for-effort-more-of-the-very-best-totally-wrong.pdf
    • http://www.gorillawalker.com/mouse-and-the-moon-made-of-cheese.pdf
    • http://www.gorillawalker.com/wallace-d-wattles-premium-collection-9-books-the-science-of.pdf
    • http://www.gorillawalker.com/the-behavior-of-the-laboratory-rat-a-handbook-with-tests.pdf
    • http://www.gorillawalker.com/differential-equations-for-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.