Malicious PDF — malware analysis report

Static analysis result for SHA-256 e97cf29f637deb11…

MALICIOUS

PDF

46.2 KB Created: 2018-11-15 18:31:47 +03:00 Authoring application: Data Dynamics ActiveReports (tm) for .NET
MD5: 35d0bc5ee48b5ea892a2f3d7343d6119 SHA-1: 91c25452552307ecee9e6a0d0640388c48ba0ee7 SHA-256: e97cf29f637deb11c572db0f642af54e74c8f07ca39f576af630a8a18e0809ff
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external websites, triggering the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm, likely intended for SEO manipulation or to redirect users to malicious content hosted on those external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7914

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/euripides-iphigenia-in-tauris-classical-texts.pdf
    • http://www.gorillawalker.com/a-mathematical-gift-iii-the-interplay-between-topology-functions-geometry.pdf
    • http://www.gorillawalker.com/parent-child-relations-context-research-and-application-3rd-edition.pdf
    • http://www.gorillawalker.com/south-asian-folklore-an-encyclopedia-special-reference.pdf
    • http://www.gorillawalker.com/the-grounds-of-faith-four-lectures-delivered-in-st-george.pdf
    • http://www.gorillawalker.com/alpha-males-four-hot-stallions-from-the-other-side-of.pdf
    • http://www.gorillawalker.com/honolulu-cop.pdf
    • http://www.gorillawalker.com/the-common-cold-and-influenza-understanding-disease.pdf
    • http://www.gorillawalker.com/sweet-dried-apples-a-vietnamese-wartime-childhood.pdf
    • http://www.gorillawalker.com/constance-spry-cookery-book.pdf
    • http://www.gorillawalker.com/your-goats-a-kid-s-guide-to-raising-and-showing.pdf
    • http://www.gorillawalker.com/promoting-and-marketing-events-theory-and-practice.pdf
    • http://www.gorillawalker.com/tony-evans-speaks-out-on-gambling-and-the-lottery.pdf
    • http://www.gorillawalker.com/parkinson-s-disease-v-1-rigidity-akinesia-behaviour.pdf
    • http://www.gorillawalker.com/toronto-easyfinder.pdf
    • http://www.gorillawalker.com/cardiac-pathology-acquired-conditions-primarily-affecting-myocardial-contractility-i-ischemic.pdf
    • http://www.gorillawalker.com/the-cup-of-destiny.pdf
    • http://www.gorillawalker.com/moonrise-moonfall-volume-4.pdf
    • http://www.gorillawalker.com/o-magnum-mysterium-conductor-score-parts-eighth-note-publications.pdf
    • http://www.gorillawalker.com/the-papin-sisters-oxford-studies-in-modern-european-culture.pdf
    • http://www.gorillawalker.com/beowulf-a-verse-translation-into-modern-english.pdf
    • http://www.gorillawalker.com/contemporary-diagnosis-and-management-of-otitis-media.pdf
    • http://www.gorillawalker.com/practical-enterprise-risk-management-how-to-optimize-business-strategies-through.pdf
    • http://www.gorillawalker.com/adagio-from-the-toccata-fugue-in-c-major-kalmus-edition.pdf
    • http://www.gorillawalker.com/foundations-of-statistical-mechanics-a-deductive-treatment-dover-books-on.pdf
    • http://www.gorillawalker.com/calculus-early-transcendental-functions-4th-forth-edition.pdf
    • http://www.gorillawalker.com/rigid-frame-formulas.pdf
    • http://www.gorillawalker.com/the-graphic-designer-s-digital-toolkit-a-project-based-introduction.pdf
    • http://www.gorillawalker.com/wall-street-words-an-a-to-z-guide-to-investment.pdf
    • http://www.gorillawalker.com/the-pink-sky.pdf
    • http://www.gorillawalker.com/the-queen-s-men-and-their-plays-review-an-article.pdf
    • http://www.gorillawalker.com/training-games-for-managing-change-50-activities-for-trainers-and.pdf
    • http://www.gorillawalker.com/destructive-testing-inspection-of-metals-vol-2.pdf
    • http://www.gorillawalker.com/dust-tactics-ssu-battle-squad.pdf
    • http://www.gorillawalker.com/gl-cklich-ist-wer-vergi-t-op-368-chorus-score.pdf
    • http://www.gorillawalker.com/doctors-lawyers-indian-chiefs.pdf
    • http://www.gorillawalker.com/interest-rate-derivatives-valuation-calibration-and-sensitivity-analysis-lecture-notes.pdf
    • http://www.gorillawalker.com/pocket-sudoku-easy-to-medium-level-a-compact-travel-friendly.pdf
    • http://www.gorillawalker.com/syria-signs-oil-epsas-with-dove-energy-dno-dublin-int.pdf
    • http://www.gorillawalker.com/brotherhood-of-warriors-behind-enemy-lines-with-a-commando-in.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.