Malicious PDF — malware analysis report

Static analysis result for SHA-256 e96eefab6c7ada43…

MALICIOUS

PDF

32.8 KB Created: 2019-09-18 05:28:59 +03:00 Authoring application: Adobe InDesign CS5 (7.0.4) (via Adobe PDF Library 9.9)
MD5: afe1bca90fc6626e01277f972b4bd869 SHA-1: 00366e50162de5c045e6a873928486e1091deb88 SHA-256: e96eefab6c7ada439166e64b7ca8bf906d04bf4e4144460d148c2e353c0e1c54
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. The embedded URLs suggest a link farm or a distribution mechanism for further malicious content, though no specific payload or script was extracted to confirm direct execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/modern-digital-halftoning-second-edition-signal-processing-and-communications.pdf
    • http://www.gorillawalker.com/game-on-nine-iq-challenges-nine-timed-quizzes-to-test.pdf
    • http://www.gorillawalker.com/fukufuku-taiwan-good-luck-travel-2011-isbn-4048990101-japanese-import.pdf
    • http://www.gorillawalker.com/critical-stability-constants-second-supplement.pdf
    • http://www.gorillawalker.com/the-jazz-standards-a-guide-to-the-repertoire.pdf
    • http://www.gorillawalker.com/talented-teenagers-the-roots-of-success-and-failure-cambridge-studies.pdf
    • http://www.gorillawalker.com/50-self-help-classics-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/top-10-longest-crabtree-contact.pdf
    • http://www.gorillawalker.com/as-old-as-time-a-culinary-odyssey-using-flavored-olive.pdf
    • http://www.gorillawalker.com/vicar-of-dibley-1-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/velocity-studies-book-2-developmental-and-progressive-studies-for-flute.pdf
    • http://www.gorillawalker.com/women-in-traditional-chinese-theater-the-heroine-s-play.pdf
    • http://www.gorillawalker.com/historic-costume-in-pictures-dover-fashion-and-costumes.pdf
    • http://www.gorillawalker.com/the-emotional-brain-physiology-neuroanatomy-physchology-and-emotion-emotions-personality.pdf
    • http://www.gorillawalker.com/what-color-is-monday.pdf
    • http://www.gorillawalker.com/complete-brazilian-portuguese.pdf
    • http://www.gorillawalker.com/ralph-masiello-s-fairy-drawing-book-ralph-masiello-s-drawing.pdf
    • http://www.gorillawalker.com/the-upward-spiral-using-neuroscience-to-reverse-the-course-of.pdf
    • http://www.gorillawalker.com/the-value-of-escharotics-medicines-which-will-destroy-any-living.pdf
    • http://www.gorillawalker.com/petrarch-s-secretum-its-making-and-its-meaning.pdf
    • http://www.gorillawalker.com/semenology-the-semen-bartender-s-handbook.pdf
    • http://www.gorillawalker.com/chip-carving-workshop-more-than-200-ready-to-use-designs.pdf
    • http://www.gorillawalker.com/girls-to-the-rescue-young-marian-s-adventures-in-sherwood.pdf
    • http://www.gorillawalker.com/josquin-des-prez-and-his-musical-legacy-an-introductory-guide.pdf
    • http://www.gorillawalker.com/the-reason-s-proper-study-essays-towards-a-neo-fregean.pdf
    • http://www.gorillawalker.com/mia-and-me-band-20-das-gro-e-fest-der.pdf
    • http://www.gorillawalker.com/fabric-of-faith-a-guide-to-the-prayer-quilt-ministry.pdf
    • http://www.gorillawalker.com/yearning-absolution-kindle-edition.pdf
    • http://www.gorillawalker.com/jumble-crosswords-a-new-twist-on-an-old-favorite-jumbles.pdf
    • http://www.gorillawalker.com/cognitive-psychotherapy-of-psychotic-and-personality-disorders-handbook-of-theory.pdf
    • http://www.gorillawalker.com/addiction-as-an-attachment-disorder.pdf
    • http://www.gorillawalker.com/hot-lights-cold-steel-life-death-and-sleepless-nights-in.pdf
    • http://www.gorillawalker.com/casa-guatemalteca-architecture-landscape-interior-design.pdf
    • http://www.gorillawalker.com/popular-music-and-society.pdf
    • http://www.gorillawalker.com/the-conspirators-unofficial-minecraft-story-the-minecraft-spy-club-book.pdf
    • http://www.gorillawalker.com/the-wheels-on-the-bus-spin-a-song-storybook.pdf
    • http://www.gorillawalker.com/space-station-auxiliary-thrust-chamber-technology-final-report-2210-90.pdf
    • http://www.gorillawalker.com/authentic-balti-curry-restaurant-recipes-revealed.pdf
    • http://www.gorillawalker.com/coaching-youth-football-second-edition.pdf
    • http://www.gorillawalker.com/modelling-and-simulation-of-stochastic-volatility-in-finance.pdf
    • http://www.gorillawalker.com/velocity-studies-book-2-developmental-and-progressi
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.