Malicious PDF — malware analysis report

Static analysis result for SHA-256 e203e1094883cf28…

MALICIOUS

PDF

43.5 KB Created: 2018-12-02 10:56:57 +03:00 Authoring application: Adobe InDesign CS (3.0.1) (via Adobe PDF Library 6.0)
MD5: 9673dad23f09001b75b23c946aaaff1a SHA-1: a351480ce5e0df82a05fde3ebd988bf1315195e6 SHA-256: e203e1094883cf28354c451ce6f0ab2951a90ad8a62ab3f3f85320ffb77e296d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern observed is the creation of a link farm, likely to drive traffic or distribute further malicious content, rather than direct exploitation within this document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/vida-sexual-de-los-papas-sexual-life-of-the-popes.pdf
    • http://www.gorillawalker.com/the-sissy-sampler-a-futanari-sissy-hypno-gender-swap-bundle.pdf
    • http://www.gorillawalker.com/2015-weekly-planner-with-inspiring-quotes-a-thoughts-that-inspire.pdf
    • http://www.gorillawalker.com/out-of-this-world-dorset-somerset.pdf
    • http://www.gorillawalker.com/astrologia-de-la-nueva-luna-spanish-edition.pdf
    • http://www.gorillawalker.com/notes-in-quantum-mechanics-and-quantum-computing.pdf
    • http://www.gorillawalker.com/the-religious-art-of-pablo-picasso.pdf
    • http://www.gorillawalker.com/star-corps-the-legacy-trilogy-book-1.pdf
    • http://www.gorillawalker.com/honors-rendered.pdf
    • http://www.gorillawalker.com/biblimericks.pdf
    • http://www.gorillawalker.com/carnevale-di-venezia-op-78-arrangement-for-flute-and-orchestra.pdf
    • http://www.gorillawalker.com/atlas-of-clinical-ophthalmology-2e.pdf
    • http://www.gorillawalker.com/trusted-billionaire-menage-romance-serial-billionaire-brothers-book-2-kindle.pdf
    • http://www.gorillawalker.com/higher-vocational-engineering-management-major-planning-materials-of-the-21st.pdf
    • http://www.gorillawalker.com/the-ultimate-guide-to-sexual-fantasy-how-to-have-incredible.pdf
    • http://www.gorillawalker.com/firefly-encyclopedia-of-insects-and-spiders.pdf
    • http://www.gorillawalker.com/trilogy-no-103-red-hot-blue.pdf
    • http://www.gorillawalker.com/case-of-the-month-discoid-lupus-erythematosus-an-article-from.pdf
    • http://www.gorillawalker.com/fibromyalgia-an-entry-from-thomson-gale-s-gale-encyclopedia-of.pdf
    • http://www.gorillawalker.com/los-bildungsromane-femeninos-de-carmen-boullosa-y-sandra-cisneros-mexicanidades.pdf
    • http://www.gorillawalker.com/scripts-librettos-for-operas-and-other-musical-works.pdf
    • http://www.gorillawalker.com/personal-and-organizational-transformations-the-true-challenge-of-continual-quality.pdf
    • http://www.gorillawalker.com/trinity-student-pranks-a-history-of-mischief-mayhem.pdf
    • http://www.gorillawalker.com/the-new-role-of-parenting-in-leadership-in-a-public.pdf
    • http://www.gorillawalker.com/veracruz-la-cocina-del-encuentro-spanish-edition.pdf
    • http://www.gorillawalker.com/people-under-power-early-jewish-and-christian-responses-to-the.pdf
    • http://www.gorillawalker.com/the-power-of-urgency-playing-to-win-with-proactive-urgency.pdf
    • http://www.gorillawalker.com/national-geographic-august-2005.pdf
    • http://www.gorillawalker.com/the-twelve-powers-of-man.pdf
    • http://www.gorillawalker.com/structural-geology-1972-532-pages-with-illustrations.pdf
    • http://www.gorillawalker.com/prophets-and-markets-the-political-economy-of-ancient-israel-population.pdf
    • http://www.gorillawalker.com/forgotten-heroes-the-canadians-at-dieppe.pdf
    • http://www.gorillawalker.com/instrumentation-and-control-systems-second-edition.pdf
    • http://www.gorillawalker.com/annual-report-of-the-board-of-managers-of-the-massachusetts.pdf
    • http://www.gorillawalker.com/designing-solutions-with-com-technologies-developer-reference.pdf
    • http://www.gorillawalker.com/music-for-two-volume-1-flute-oboe-or-violin-published.pdf
    • http://www.gorillawalker.com/biblia-letra-grande-rv-1909-spanish-edition.pdf
    • http://www.gorillawalker.com/a-virgin-s-diary.pdf
    • http://www.gorillawalker.com/ocean-city-a-guide-to-maryland-s-seaside-resort-tourist.pdf
    • http://www.gorillawalker.com/leaders-playbook-how-to-apply-emotional-intelligence-keys-to-great.pdf
    • http://www.gorillawalker.com/carneval
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.