Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8283a16b52b8135…

MALICIOUS

PDF

43.8 KB Created: 2019-02-14 08:25:14 +03:00 Authoring application: - (via Xerox Fiery DC250 2.0[EFI Cyclone])
MD5: ed23e75c4ed25492416b874225803f9d SHA-1: 37487631c64d0061c5127765d86bce81e1027390 SHA-256: e8283a16b52b8135025e54fb0a03d55466a32873dd61eeb0df6323d50863f3c4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a critical heuristic for containing a large number of external links, specifically a link farm. The ML classifier also indicated a high probability of maliciousness. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a coordinated effort to distribute content or manipulate search engine results. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/aerodynamics-constituting-the-first-volume-of-a-complete-work-on.pdf
    • http://www.gorillawalker.com/aircraft-shapes-and-their-aerodynamics-for-flight-at-supersonic-speeds.pdf
    • http://www.gorillawalker.com/imperial-entanglements-a-star-wars-miniatures-expansion-star-wars-miniatures.pdf
    • http://www.gorillawalker.com/tips-for-producing-realistic-pencil-drawings-kindle-edition.pdf
    • http://www.gorillawalker.com/the-consequences-of-possession-edinburgh-studies-in-law.pdf
    • http://www.gorillawalker.com/precalculus-your-student-study-pack.pdf
    • http://www.gorillawalker.com/ghost-ranch-for-orchestra-full-score.pdf
    • http://www.gorillawalker.com/town-houses.pdf
    • http://www.gorillawalker.com/the-obama-administration-s-november-2014-immigration-initiatives-questions-and.pdf
    • http://www.gorillawalker.com/calendar-of-the-roman-republic.pdf
    • http://www.gorillawalker.com/holy-terror-armageddon-in-tokyo.pdf
    • http://www.gorillawalker.com/fingerprint-classification-and-interpretation-simplified-3rd-edition.pdf
    • http://www.gorillawalker.com/the-crow-the-story-behind-the-film.pdf
    • http://www.gorillawalker.com/good-bye-robinson-crusoe-and-other-stories.pdf
    • http://www.gorillawalker.com/compact-advanced-student-s-book-with-answers-with-cd-rom.pdf
    • http://www.gorillawalker.com/skiing-winter-sports.pdf
    • http://www.gorillawalker.com/gerald-ford-and-the-challenges-of-the-1970s.pdf
    • http://www.gorillawalker.com/edible-and-poisonous-mushrooms-of-the-world.pdf
    • http://www.gorillawalker.com/hungary-road-map-with-index-1-450000-budapest-city-and.pdf
    • http://www.gorillawalker.com/the-business-of-fashion-designing-manufacturing-and-marketing.pdf
    • http://www.gorillawalker.com/spectroscopy-the-key-to-the-stars-reading-the-lines-in.pdf
    • http://www.gorillawalker.com/2011-calgary-calendar-wall-calendar-calendar.pdf
    • http://www.gorillawalker.com/exile.pdf
    • http://www.gorillawalker.com/tristan-und-isolde-libretto-opera.pdf
    • http://www.gorillawalker.com/the-magic-furnace-the-search-for-the-origins-of-atoms.pdf
    • http://www.gorillawalker.com/the-creation-secular-jewish-catholic-protestant-and-muslim-perspectives-analyzed.pdf
    • http://www.gorillawalker.com/counter-guerrilla-operations-the-philippine-experience-psi-classics-of-the.pdf
    • http://www.gorillawalker.com/don-t-rock-the-boat-capsize-it-loving-the-church.pdf
    • http://www.gorillawalker.com/instrumentalmusik-joseph-haydns-aus-der-sicht-heinrich-christoph-kochs-beitrage.pdf
    • http://www.gorillawalker.com/fred-s-smogged-filled-adventure-kindle-edition.pdf
    • http://www.gorillawalker.com/dieselmotor-management-systeme-komponenten-steuerung-und-regelung-bosch-fachinformation-automobil.pdf
    • http://www.gorillawalker.com/unmistakably-black-sculpture-and-paintings-from-the-world-s-first.pdf
    • http://www.gorillawalker.com/moment-maker-you-can-live-your-life-or-it-will.pdf
    • http://www.gorillawalker.com/analytical-concordance-to-the-bible-on-an-entirely-new-plan.pdf
    • http://www.gorillawalker.com/confessions-of-a-gay-globetrotter.pdf
    • http://www.gorillawalker.com/annual-reports-on-nmr-spectroscopy-volume-84.pdf
    • http://www.gorillawalker.com/the-photoshop-workbook-professional-retouching-and-compositing-tips-tricks-and.pdf
    • http://www.gorillawalker.com/clair-de-terre-collection-pobesie.pdf
    • http://www.gorillawalker.com/electromagnetic-anechoic-chambers-a-fundamental-design-and-specification-guide.pdf
    • http://www.gorillawalker.com/destination-d-c-gateway-volume-2.pdf
    • http://www.gorillawalker.com/the-obama-administration-s-november-2014-immigratio
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.