Malicious PDF — malware analysis report

Static analysis result for SHA-256 e55db886b3628861…

MALICIOUS

PDF

32.9 KB Created: 2020-01-10 17:21:41 +03:00 Authoring application: CorelDRAW X5 (via Corel PDF Engine Version 15.1.0.588)
MD5: 31182c9fb313e18f6b977d88bcc733f2 SHA-1: 265cddc4ba1d1bf44ab28d8872e1c6ff40f1f989 SHA-256: e55db886b36288616a2f74e9553e7c9aa6f9d4972f92608f67654b3e5ae5feae
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, characteristic of a link farm or SEO manipulation tactic. The primary heuristic identified a 'PDF_SEO_LINK_FARM' with 32 external links, suggesting the document's purpose is to distribute these links. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/6-grandes-marches-d-819-marche-heroique-no-3-for.pdf
    • http://www.gorillawalker.com/plan-your-defence-how-to-play-bridge.pdf
    • http://www.gorillawalker.com/belwin-master-solos-for-clarinet-volume-1-advanced-clarinet-solo.pdf
    • http://www.gorillawalker.com/mechanics-of-fluids-seventh-edition.pdf
    • http://www.gorillawalker.com/dollars-and-sense-developing-good-money-habits-slim-goodbody-s.pdf
    • http://www.gorillawalker.com/the-political-economy-of-state-owned-enterprises-in-china-and.pdf
    • http://www.gorillawalker.com/picasso-and-the-girl-with-a-ponytail-anholt-s-artists.pdf
    • http://www.gorillawalker.com/girl-time-literacy-justice-and-school-to-prison-pipeline-teaching.pdf
    • http://www.gorillawalker.com/personal-finance-for-beginners-in-30-minutes-volume-2-how.pdf
    • http://www.gorillawalker.com/cat-s-hat-first-phonics-fun-first-phonics-fun-level.pdf
    • http://www.gorillawalker.com/godard-suite-de-trois-morceaux-flt-pf-chester-woodwind-series.pdf
    • http://www.gorillawalker.com/an-accidental-diplomat.pdf
    • http://www.gorillawalker.com/club-swinging-for-physical-exercise-and-recreation.pdf
    • http://www.gorillawalker.com/lo-mejor-de-la-cocina-mexicana-the-best-of-mexican.pdf
    • http://www.gorillawalker.com/from-preschool-to-the-penitentiary.pdf
    • http://www.gorillawalker.com/sex-true-homosexual-experiences-from-sth-writers.pdf
    • http://www.gorillawalker.com/one-summer-america-1927-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/cookie-count-a-tasty-pop-up.pdf
    • http://www.gorillawalker.com/more-hot-sex-how-to-do-it-longer-better-and.pdf
    • http://www.gorillawalker.com/appalachian-spring-suite.pdf
    • http://www.gorillawalker.com/diabetes-sin-problemas-el-control-de-la-diabetes-con-la.pdf
    • http://www.gorillawalker.com/force-ennemie-roman-1904.pdf
    • http://www.gorillawalker.com/up-your-score-the-underground-guide-to-the-new-sat.pdf
    • http://www.gorillawalker.com/harcourt-math-florida-edition-unit-6-emploring-greater-numbers-and.pdf
    • http://www.gorillawalker.com/struggle-for-intimacy-adult-children-of-alcoholics-series.pdf
    • http://www.gorillawalker.com/english-no-problem-book-1.pdf
    • http://www.gorillawalker.com/ceramic-superconductors-proceedings-of-the-xi-winter-meeting-on-low.pdf
    • http://www.gorillawalker.com/gerd-and-acid-reflux-solutions-your-guide-to-prevention-treatment.pdf
    • http://www.gorillawalker.com/mistral-workbk-stage-1-paperback.pdf
    • http://www.gorillawalker.com/liang-s-treasure-global-kids-storybooks.pdf
    • http://www.gorillawalker.com/modern-theory-of-anistropic-elasticity-and-applications-proceedings-in-applied.pdf
    • http://www.gorillawalker.com/used-volkswagen-golf-buyer-s-guide.pdf
    • http://www.gorillawalker.com/thin-layer-chromatography-a-laboratory-introduction.pdf
    • http://www.gorillawalker.com/willie-s-way-6-secrets-for-wooing-wowing-and-winning.pdf
    • http://www.gorillawalker.com/more-than-chattel-black-women-and-slavery-in-the-americas.pdf
    • http://www.gorillawalker.com/in-search-of-the-good-life-the-ethics-of-globalization.pdf
    • http://www.gorillawalker.com/pierce-fire-apparatus-1939-2006-an-illustrated-history.pdf
    • http://www.gorillawalker.com/atlas-of-the-celts.pdf
    • http://www.gorillawalker.com/couples-a-novel.pdf
    • http://www.gorillawalker.com/2600-typographic-ornaments-and-designs.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.