Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8141d3ec9eb6e40…

MALICIOUS

PDF

44.2 KB Created: 2018-12-07 18:27:50 +03:00 Authoring application: CorelDRAW X5 (via Corel PDF Engine Version 15.1.0.588)
MD5: db7a581e907e18498e08553bf89a8b39 SHA-1: b17f8f4394c06234039b8975c6156ab4b36daf1a SHA-256: e8141d3ec9eb6e409c13af58dc59f3333b1996e6e5e694c0ea34881801f16108
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this document as malicious. While no scripts were extracted, the sheer volume of links suggests a coordinated effort to direct users to potentially harmful content, possibly for SEO manipulation or to host further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8859

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/using-the-internet-safely-for-seniors-for-dummies.pdf
    • http://www.gorillawalker.com/1992-trading-cards-factory-set-750-card-complete-set-advanced.pdf
    • http://www.gorillawalker.com/dana-s-first-fish.pdf
    • http://www.gorillawalker.com/shamanic-journeying-a-beginner-s-guide.pdf
    • http://www.gorillawalker.com/heroes-de-barro-descubre-el-arte-de-proteger-a-tu.pdf
    • http://www.gorillawalker.com/everlasting-peace-10-hymn-arrangements-based-on-the-theme-of.pdf
    • http://www.gorillawalker.com/fantasy-football-tips-to-take-your-team-from-beginning-to.pdf
    • http://www.gorillawalker.com/basc-handbook-pest-and-predator-control-basc-handbooks-kindle-edition.pdf
    • http://www.gorillawalker.com/saxon-phonics-spelling-k-fluency-reader-the-milk-spills.pdf
    • http://www.gorillawalker.com/total-quality-in-the-construction-supply-chain.pdf
    • http://www.gorillawalker.com/from-bangkok-to-siberia-via-the-marrakech-express-russia-morocco.pdf
    • http://www.gorillawalker.com/taxes-made-simple-income-taxes-explained-in-100-pages-or.pdf
    • http://www.gorillawalker.com/vegetables-first-step-nonfiction.pdf
    • http://www.gorillawalker.com/the-thunder-and-the-sunshine-four-seasons-in-a-burnished.pdf
    • http://www.gorillawalker.com/the-adirondack-cookbook.pdf
    • http://www.gorillawalker.com/the-african-baobab-paperback.pdf
    • http://www.gorillawalker.com/aristotle-and-poetic-justice-an-aristotle-detective-novel-paperback.pdf
    • http://www.gorillawalker.com/the-everything-kids-baseball-book-from-baseball-s-history-to.pdf
    • http://www.gorillawalker.com/piano-sonatas-vol-2-nos-16-32-schirmer-performance-edition.pdf
    • http://www.gorillawalker.com/a-divided-paradise-an-irishman-in-the-holy-land.pdf
    • http://www.gorillawalker.com/concerto-trombone-and-piano.pdf
    • http://www.gorillawalker.com/art-in-china-oxford-history-of-art.pdf
    • http://www.gorillawalker.com/decisions-computers-and-medicines-the-informatics-of-pharmacotherapy-1e.pdf
    • http://www.gorillawalker.com/rice-biofortification-lessons-for-global-science-and-development-pathways-to.pdf
    • http://www.gorillawalker.com/the-lincoln-memorial-pull-ahead-books.pdf
    • http://www.gorillawalker.com/origins-of-buddhist-monastic-codes-in-china-classics-in-east.pdf
    • http://www.gorillawalker.com/2500-solved-problems-in-fluid-mechanics-and-hydraulics-schaum-s.pdf
    • http://www.gorillawalker.com/combat-baguazhang-nine-dragon-system-volume-two.pdf
    • http://www.gorillawalker.com/matthew-the-circle-eight-book-1.pdf
    • http://www.gorillawalker.com/caring-for-a-dying-relative-a-guide-for-families.pdf
    • http://www.gorillawalker.com/boston-the-delaplaine-2015-long-weekend-guide-long-weekend-guides.pdf
    • http://www.gorillawalker.com/the-theory-of-the-leisure-class-unabridged.pdf
    • http://www.gorillawalker.com/the-brazilian-empire-myths-and-histories.pdf
    • http://www.gorillawalker.com/analysis-of-finite-difference-schemes-for-linear-partial-differential-equations.pdf
    • http://www.gorillawalker.com/2012-gooseberry-patch-wall-calendar-gooseberry-patch-calendars.pdf
    • http://www.gorillawalker.com/bremen-cycling-tour-map-2014-bikerw-de-hb1.pdf
    • http://www.gorillawalker.com/objects-first-with-java-a-practical-introduction-using-bluej-5.pdf
    • http://www.gorillawalker.com/death-and-eternal-life.pdf
    • http://www.gorillawalker.com/penguins-swim-but-don-t-get-wet-and-other-amazing.pdf
    • http://www.gorillawalker.com/inside-the-black-box-of-classroom-practice-change-without-reform.pdf
    • http://www.gorillawalker.com/dana-s-fir
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.