Malicious PDF — malware analysis report

Static analysis result for SHA-256 e601de504a6e6f44…

MALICIOUS

PDF

43.0 KB Created: 2019-04-02 22:43:35 +03:00 Authoring application: ESP Ghostscript 815.02
MD5: 78beba5497db5edebbf4698b53ef460f SHA-1: 40d28fd6818d9ff6f091e67a8c471716ea169e4a SHA-256: e601de504a6e6f44f270bd7e02430174a55324c9c6413d31fa64d6fe4cc9e076
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or to distribute further malicious content through the linked PDFs. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-land-of-literary-glory.pdf
    • http://www.gorillawalker.com/the-postwar-novel-in-canada-narrative-patterns-and-reader-response.pdf
    • http://www.gorillawalker.com/a-room-hebrew-literature-series.pdf
    • http://www.gorillawalker.com/you-are-the-city-observation-organization-and-transformation-of-urban.pdf
    • http://www.gorillawalker.com/between-nostalgia-and-apocalypse-popular-music-and-the-staging-of.pdf
    • http://www.gorillawalker.com/guide-to-wildlife-sounds-a-the-sounds-of-100-mammals.pdf
    • http://www.gorillawalker.com/the-printing-times-and-lithogapher-volume-6-an-illustrated-monthly.pdf
    • http://www.gorillawalker.com/lassie-come-home-75th-anniversary-edition-digital.pdf
    • http://www.gorillawalker.com/anna-bolena-act-ii-scena-ed-aria-mezzo-per-questa.pdf
    • http://www.gorillawalker.com/death-taxes-and-leaky-waders-a-john-gierach-fly-fishing.pdf
    • http://www.gorillawalker.com/german-and-european-poetics-after-the-holocaust-crisis-and-creativity.pdf
    • http://www.gorillawalker.com/we-the-animals.pdf
    • http://www.gorillawalker.com/ghost-of-thomas-kempe.pdf
    • http://www.gorillawalker.com/the-reign-of-christ-the-king.pdf
    • http://www.gorillawalker.com/a-little-ray-of-sunshine.pdf
    • http://www.gorillawalker.com/the-time-machine.pdf
    • http://www.gorillawalker.com/emotional-impact-american-figurative-expressionism.pdf
    • http://www.gorillawalker.com/fruit-salad-poems-for-children.pdf
    • http://www.gorillawalker.com/back-to-basics-strategy-back-to-basics-chess-series.pdf
    • http://www.gorillawalker.com/favorite-medieval-tales.pdf
    • http://www.gorillawalker.com/the-art-of-fashion-draping.pdf
    • http://www.gorillawalker.com/reading-black-reading-feminist-a-critical-anthology-meridian.pdf
    • http://www.gorillawalker.com/i-m-changing.pdf
    • http://www.gorillawalker.com/prentice-hall-literature-grade-10-student-edition-fourth-edition.pdf
    • http://www.gorillawalker.com/beyond-article-19-libraries-and-social-and-cultural-rights.pdf
    • http://www.gorillawalker.com/italian-nights.pdf
    • http://www.gorillawalker.com/aqa-as-business-studies-unit-1-planning-and-financing-a.pdf
    • http://www.gorillawalker.com/economic-and-financial-analysis-for-engineering-and-project-management.pdf
    • http://www.gorillawalker.com/practical-phased-array-antenna-systems-artech-house-antenna-library.pdf
    • http://www.gorillawalker.com/quaker-tapestry.pdf
    • http://www.gorillawalker.com/jedi-academy-2-return-of-the-padawan.pdf
    • http://www.gorillawalker.com/the-wild-orchids-of-arizona-and-new-mexico-comstock-books.pdf
    • http://www.gorillawalker.com/east-of-warsaw.pdf
    • http://www.gorillawalker.com/summer-activity-book-puzzles-mazes-and-word-games.pdf
    • http://www.gorillawalker.com/malaysia-and-singapore.pdf
    • http://www.gorillawalker.com/slawische-literaturen-sterreichische-literatur-en-herausgegeben-von-fedor-b-poljakov.pdf
    • http://www.gorillawalker.com/the-white-knight-syndrome-rescuing-yourself-from-your-need-to.pdf
    • http://www.gorillawalker.com/top-secret-a-handbook-of-codes-ciphers-and-secret-writing.pdf
    • http://www.gorillawalker.com/evolution-creation-intelligent-design-hybrids-which-ones-are-scientific.pdf
    • http://www.gorillawalker.com/diamorphine-its-chemistry-pharmacology-and-clinical-use.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.