Malicious PDF — malware analysis report

Static analysis result for SHA-256 e365ccb21f97d21e…

MALICIOUS

PDF

43.6 KB Created: 2018-12-15 21:27:04 +03:00 Authoring application: Microsoft Word: AdobePS 8.7.3 (301) (via Acrobat Distiller 5.0.5 for Macintosh)
MD5: 1093a8e7f3d84d8a629cd2321d1d54c1 SHA-1: c3b83a62a6d67f89b40521d673dca2fdc9b06df5 SHA-256: e365ccb21f97d21e9041dbd60a5e56ba081652b52fe026931a185bb6859f549d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and a critical heuristic for containing a large number of external links. The embedded URLs, all pointing to the same domain with seemingly innocuous filenames, suggest a link farm or a method to distribute malicious content disguised as legitimate documents. No scripts were extracted, but the sheer volume of links indicates a high likelihood of malicious intent, possibly for SEO poisoning or redirecting users to phishing or malware download sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/emergence-and-diversity-of-modern-human-behavior-in-paleolithic-asia.pdf
    • http://www.gorillawalker.com/the-lost-weekend-the-complete-screenplay.pdf
    • http://www.gorillawalker.com/the-three-little-pigs-paul-galdone-classics.pdf
    • http://www.gorillawalker.com/born-to-return-the-gift.pdf
    • http://www.gorillawalker.com/sandy-hank-couples-erotica.pdf
    • http://www.gorillawalker.com/helpin-children-deal-with-trauma-and-terrorism-eric-eece-report.pdf
    • http://www.gorillawalker.com/psychotherapy-and-religion-in-japan-the-japanese-introspection-practice-of.pdf
    • http://www.gorillawalker.com/african-american-genealogical-research-how-to-trace-your-family-history.pdf
    • http://www.gorillawalker.com/our-one-common-country-abraham-lincoln-and-the-hampton-roads.pdf
    • http://www.gorillawalker.com/nightlights-more-bedtime-hugs-for-little-ones.pdf
    • http://www.gorillawalker.com/the-best-peanut-butter-sandwich-recipes-kindle-edition.pdf
    • http://www.gorillawalker.com/muybridge-s-complete-human-and-animal-locomotion-vol-1-males.pdf
    • http://www.gorillawalker.com/war-torn-love-kindle-edition.pdf
    • http://www.gorillawalker.com/mary-magdalene-transformed-resurrection-drama-3-resurrection-dramas-kindle-edition.pdf
    • http://www.gorillawalker.com/the-high-cost-of-holistic-healing-a-concise-examination-of.pdf
    • http://www.gorillawalker.com/the-jet-alphabet-book.pdf
    • http://www.gorillawalker.com/history-of-political-theory-an-introduction-volume-ii-modern-volume.pdf
    • http://www.gorillawalker.com/bond-plays-2-lear-the-sea-narrow-road-to-the.pdf
    • http://www.gorillawalker.com/great-lives-job-a-man-of-heroic-endurance-great-lives.pdf
    • http://www.gorillawalker.com/nine-coins-nueve-monedas.pdf
    • http://www.gorillawalker.com/wheel-of-misfortune-7-dragon-slayers-academy.pdf
    • http://www.gorillawalker.com/the-dark-side-of-innocence-growing-up-bipolar-kindle-edition.pdf
    • http://www.gorillawalker.com/the-new-cure-for-herpes.pdf
    • http://www.gorillawalker.com/building-the-bay-colony-local-economy-and-culture-in-early.pdf
    • http://www.gorillawalker.com/rural-communism-in-france-1920-1939.pdf
    • http://www.gorillawalker.com/the-orc-s-treasure.pdf
    • http://www.gorillawalker.com/photographic-possibilities-the-expressive-use-of-equipment-ideas-materials-and.pdf
    • http://www.gorillawalker.com/mafia-princess-part-5-the-takeover.pdf
    • http://www.gorillawalker.com/the-secret-love-marriage-and-hiv.pdf
    • http://www.gorillawalker.com/independence-day-for-children-the-amazing-story-of-the-fourth.pdf
    • http://www.gorillawalker.com/el-polonio-y-otras-maneras-de-matar-asi-asesinan-los.pdf
    • http://www.gorillawalker.com/the-book-of-discipline-of-the-united-methodist-church-2012.pdf
    • http://www.gorillawalker.com/trespassing-through-shadows-memory-photography-and-the-holocaust-visible-evidence.pdf
    • http://www.gorillawalker.com/crete-marco-polo-travel-guides.pdf
    • http://www.gorillawalker.com/500-common-bird-calls-in-southern-africa.pdf
    • http://www.gorillawalker.com/eugene-o-neill-s-america-desire-under-democracy.pdf
    • http://www.gorillawalker.com/what-your-doctor-may-not-tell-you-about-pediatric-fibromyalgia.pdf
    • http://www.gorillawalker.com/p-51d-mustang-american-aces-spotlight-on.pdf
    • http://www.gorillawalker.com/quietly-at-work-township-government-in-america.pdf
    • http://www.gorillawalker.com/to-market-to-market.pdf
    • http://www.gorill
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.