Malicious PDF — malware analysis report

Static analysis result for SHA-256 ead05c8fd820b6df…

MALICIOUS

PDF

44.0 KB Created: 2018-11-15 18:32:53 +03:00 Authoring application: - (via pdfTeX-1.0b-pdfcrypt)
MD5: 9e99135d7e73955b1af6fe32177a8fa6 SHA-1: 16877619b40cd0658516c693b34ed706ea259f6f SHA-256: ead05c8fd820b6df7d0a49edda23c115f757d39e46496ace4248f86ef4414b4a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by an ML classifier and contains a significant number of embedded external links, characteristic of a link farm. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with 32 external links, suggesting a coordinated effort to manipulate search engine results or distribute content. While no scripts were extracted, the sheer volume of links points towards a malicious intent, likely to lead users to potentially harmful content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-aliens-are-coming-easy-to-read-level-2.pdf
    • http://www.gorillawalker.com/atlantic-city-ocean-city-champion.pdf
    • http://www.gorillawalker.com/the-dynamics-and-use-of-lacustrine-ecosystems-developments-in-hydrobiology.pdf
    • http://www.gorillawalker.com/the-kansas-city-medical-index-lancet-v-10-no-12.pdf
    • http://www.gorillawalker.com/sports-check.pdf
    • http://www.gorillawalker.com/self-representation-before-international-criminal-tribunals-schriften-zum-internationalen-und.pdf
    • http://www.gorillawalker.com/early-settler-children-early-settler-life-series.pdf
    • http://www.gorillawalker.com/theorien-der-ethnizit-t-eine-sozialwissenschaftliche-einf-hrung-mit-quellen.pdf
    • http://www.gorillawalker.com/statistical-methods.pdf
    • http://www.gorillawalker.com/otherworld-secrets.pdf
    • http://www.gorillawalker.com/medical-abbreviations-32-000-conveniences-at-the-expense-of-communication.pdf
    • http://www.gorillawalker.com/sourcebook-of-korean-civilization-vol-1-from-early-times-to.pdf
    • http://www.gorillawalker.com/17-year-heisei-version-past-questions-removed-by-the-civil.pdf
    • http://www.gorillawalker.com/the-sunday-times-illustrated-history-of-football.pdf
    • http://www.gorillawalker.com/school-survival-keeping-your-cool-at-school-essential-health-strong.pdf
    • http://www.gorillawalker.com/the-deer-in-the-wood-little-house.pdf
    • http://www.gorillawalker.com/radiestesia-spanish-edition.pdf
    • http://www.gorillawalker.com/the-postmodern-organization-mastering-the-art-of-irreversible-change-jossey.pdf
    • http://www.gorillawalker.com/understanding-the-predictive-analytics-lifecycle-wiley-and-sas-business-series.pdf
    • http://www.gorillawalker.com/legislaci-n-a-rea-air-law-spanish-edition.pdf
    • http://www.gorillawalker.com/windows-10-fast-start-a-quick-start-guide-for-windows.pdf
    • http://www.gorillawalker.com/china-bayles-book-of-days.pdf
    • http://www.gorillawalker.com/lost-in-london.pdf
    • http://www.gorillawalker.com/family-therapy-concepts-and-methods-sixth-edition.pdf
    • http://www.gorillawalker.com/the-winter-of-our-disconnect-how-three-totally-wired-teenagers.pdf
    • http://www.gorillawalker.com/the-melting-pot-a-quick-and-easy-blend-of-israeli.pdf
    • http://www.gorillawalker.com/the-restoration-of-rome-barbarian-popes-and-imperial-pretenders-unabridged.pdf
    • http://www.gorillawalker.com/electric-pressure-cooker-recipes-over-100-delicious-quick-and-easy.pdf
    • http://www.gorillawalker.com/character-and-health-the-relationship-of-acupuncture-and-psychology-paradigm.pdf
    • http://www.gorillawalker.com/guide-to-british-naval-papers-in-north-a.pdf
    • http://www.gorillawalker.com/the-joy-luck-club-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/observations-in-the-north-civil-war.pdf
    • http://www.gorillawalker.com/la-idea-de-comunidad-de-pablo-spanish-edition.pdf
    • http://www.gorillawalker.com/just-like-me-stories-and-self-portraits-by-fourteen-artists.pdf
    • http://www.gorillawalker.com/mountain-bike-training-for-all-levels-of-performance.pdf
    • http://www.gorillawalker.com/transitions-in-dying-and-bereavement-a-psychosocial-guide-for-hospice.pdf
    • http://www.gorillawalker.com/palm-sunday-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/spices-flavor-chemistry-and-antioxidant-properties-acs-symposium.pdf
    • http://www.gorillawalker.com/the-frightened-land-land-landscape-and-politics-in-south-africa.pdf
    • http://www.gorillawalker.com/health-reference-series-cumulative-index-a-comprehensive-index-to-the.pdf
    • http://www.gorillawalker.com/self-representation-before-internatio
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.