Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9469ce997831594…

MALICIOUS

PDF

31.4 KB Created: 2020-05-01 12:33:54 +03:00 Authoring application: Microsoft Word (via Acrobat PDFWriter 4.0 para Windows)
MD5: 8b4d2a6425fa98569c304a416f3e26e0 SHA-1: 659a40a3bb9d748b8cb59db685f1c1f843b4b51c SHA-256: e9469ce9978315942802d990ac3b2389ff20066a4bd06dd6be917082af4027f0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or distribution mechanism. The ML classifier also indicated a high probability of maliciousness. The embedded URLs point to various book titles, likely serving as a lure to encourage clicks. No scripts were extracted, and the document body contained mostly binary data, making it difficult to ascertain the exact user-facing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8447

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-germans-in-normandy-kindle-edition.pdf
    • http://www.gorillawalker.com/the-twelve-seals-seals-series-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/australia-you-little-beauty-inside-test-cricket-s-dream-team.pdf
    • http://www.gorillawalker.com/the-million-dollar-mermaid-an-autobiography.pdf
    • http://www.gorillawalker.com/no-redemption.pdf
    • http://www.gorillawalker.com/macarons-authentic-french-cookie-recipes-from-the-macaron-cafe.pdf
    • http://www.gorillawalker.com/dawn-california-diaries-no-1.pdf
    • http://www.gorillawalker.com/hands-up.pdf
    • http://www.gorillawalker.com/soccer-secrets-package-44-secrets-for-playing-great-soccer-44.pdf
    • http://www.gorillawalker.com/mail-order-bride-cowboy-finds-beauty-within-the-abused-pregnant.pdf
    • http://www.gorillawalker.com/the-lusts-of-her-flesh-a-christian-woman-s-real.pdf
    • http://www.gorillawalker.com/the-forty-days-of-musa-dagh.pdf
    • http://www.gorillawalker.com/a-field-guide-to-the-families-and-genera-of-woody.pdf
    • http://www.gorillawalker.com/alfred-championship-sports-pak-trombone.pdf
    • http://www.gorillawalker.com/health-qigong-taiji-stick-heatlh-perservation-exercises.pdf
    • http://www.gorillawalker.com/little-bear-an-i-can-read-book.pdf
    • http://www.gorillawalker.com/structural-analysis-a-unified-classical-and-matrix-approach.pdf
    • http://www.gorillawalker.com/the-twible-all-the-chapters-of-the-bible-in-140.pdf
    • http://www.gorillawalker.com/flower-essences-a-basic-guide.pdf
    • http://www.gorillawalker.com/geothermal-power-compact-research-series.pdf
    • http://www.gorillawalker.com/marketa-luskacova.pdf
    • http://www.gorillawalker.com/shakespeare-made-easy-julius-caesar-shakespeare-made-easy-study-guides.pdf
    • http://www.gorillawalker.com/rodin-eros-and-creativity-art-design.pdf
    • http://www.gorillawalker.com/buddhist-suttas.pdf
    • http://www.gorillawalker.com/irreplaceable-harmony-volume-2.pdf
    • http://www.gorillawalker.com/coloring-medieval-times-featuring-the-artwork-of-celebrated-illustrator-levi.pdf
    • http://www.gorillawalker.com/flow-through-open-channels-oxford-higher-education.pdf
    • http://www.gorillawalker.com/beyond-buildings-designed-spaces-as-visual-persuasion.pdf
    • http://www.gorillawalker.com/helping-friends.pdf
    • http://www.gorillawalker.com/reading-writing-and-rising-up-teaching-about-social-justice-and.pdf
    • http://www.gorillawalker.com/surface-coatings-vol-1.pdf
    • http://www.gorillawalker.com/songs-of-the-1980s-clarinet-80s-eighties-decade-the-decade.pdf
    • http://www.gorillawalker.com/estadistica-comercial-de-la-rep-blica-de-chile-spanish-edition.pdf
    • http://www.gorillawalker.com/figure-photography-techniques-for-digital-photographers.pdf
    • http://www.gorillawalker.com/the-pesticide-detox-towards-a-more-sustainable-agriculture.pdf
    • http://www.gorillawalker.com/really-cool-felt-crafts-quick-starts-for-kids.pdf
    • http://www.gorillawalker.com/witness-to-betrayal-profiles-of-provocateurs.pdf
    • http://www.gorillawalker.com/the-sperrins-lamfold-irish-discoverer-map.pdf
    • http://www.gorillawalker.com/developmental-mathematics-4th-edition-includes-partial-solutions.pdf
    • http://www.gorillawalker.com/liferay-6-x-portal-enterprise-intranets-cookbook.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.