Malicious PDF — malware analysis report

Static analysis result for SHA-256 eaf87f0b46cae525…

MALICIOUS

PDF

45.2 KB Created: 2018-12-02 10:56:39 +03:00 Authoring application: Arbortext Publishing Engine (via PDFlib+PDI 8.0.2p1 (Win32))
MD5: 47c2692e35626d217fb661f8e3f36f0b SHA-1: c0ba8477157d54e1782eeec2354cc166889f9d9d SHA-256: eaf87f0b46cae525524adc7d803060e4344df991f0fc2a7b5130aabb36744f0d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF was flagged by a machine learning classifier and contains a large number of embedded URLs, indicating a link farm or SEO spam tactic. The primary heuristic identified 32 external PDF links, suggesting the document's purpose is to redirect users to a multitude of other PDF documents hosted on the same domain. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8600

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/modern-indian-fiction.pdf
    • http://www.gorillawalker.com/learning-together-a-history-of-coeducation-in-american-public-schools.pdf
    • http://www.gorillawalker.com/questions-answers-international-law.pdf
    • http://www.gorillawalker.com/medjugorje-the-90-s.pdf
    • http://www.gorillawalker.com/acca-p1-governance-risk-and-ethics-revision-kit.pdf
    • http://www.gorillawalker.com/mecanismos-de-defensa-fiscal-bajo-el-sistema-normativo-mexicano-spanish.pdf
    • http://www.gorillawalker.com/the-impact-of-inequality-how-to-make-sick-societies-healthier.pdf
    • http://www.gorillawalker.com/mapa-mallorca-tramontana-centro-geoestel.pdf
    • http://www.gorillawalker.com/a-summary-of-biblical-antiquities-for-the-use-of-schools.pdf
    • http://www.gorillawalker.com/my-journey-memoir-of-a-true-master.pdf
    • http://www.gorillawalker.com/s-corporation-answer-book-2012-cumulative-supplement.pdf
    • http://www.gorillawalker.com/application-of-nonlinear-systems-in-nanomechanics-and-nanofluids-analytical-methods.pdf
    • http://www.gorillawalker.com/readers-theater-bible-based-dramas-new-testament.pdf
    • http://www.gorillawalker.com/learning-to-teach-for-social-justice-multicultural-education-multicultural-education.pdf
    • http://www.gorillawalker.com/bodyguards-in-love-volume-one-brier-s-bargain-seb-s.pdf
    • http://www.gorillawalker.com/canadian-book-of-the-road.pdf
    • http://www.gorillawalker.com/the-art-of-prolog-second-edition-advanced-programming-techniques-logic.pdf
    • http://www.gorillawalker.com/guitar-fingers-essential-technique-in-pictures.pdf
    • http://www.gorillawalker.com/easy-to-understand-bookkeeping.pdf
    • http://www.gorillawalker.com/his-slave.pdf
    • http://www.gorillawalker.com/early-reading-instruction-what-science-really-tells-us-about-how.pdf
    • http://www.gorillawalker.com/food-and-drink-service-levels-1-and-2.pdf
    • http://www.gorillawalker.com/laser-in-urology.pdf
    • http://www.gorillawalker.com/dr-m-s-seven-x-plan-for-digestive-health-acid.pdf
    • http://www.gorillawalker.com/the-improbable-adventures-of-sherlock-holmes.pdf
    • http://www.gorillawalker.com/ana-frank-la-biografia-grafica-the-graphic-biography-spanish-edition.pdf
    • http://www.gorillawalker.com/the-dhammapada-your-guide-on-the-path-to-enlightenment-in.pdf
    • http://www.gorillawalker.com/fairchild-c-82-packet-c-119-flying-boxcar-aerofax.pdf
    • http://www.gorillawalker.com/an-account-of-the-past-and-present-state-of-the.pdf
    • http://www.gorillawalker.com/modern-interest-rate-theory.pdf
    • http://www.gorillawalker.com/fondant-kindle-edition.pdf
    • http://www.gorillawalker.com/narcissism-unleashed-cure-for-controlling-people-human-behavior-box-set.pdf
    • http://www.gorillawalker.com/how-to-do-a-handstand-from-the-basic-exercises-to.pdf
    • http://www.gorillawalker.com/the-secret-billionaire-bwwm-bbw-interracial-erotica.pdf
    • http://www.gorillawalker.com/aqua-part-three-serial-edition-elements-series-aqua-serial-edition.pdf
    • http://www.gorillawalker.com/publishing-your-medical-research-paper-what-they-don-t-teach.pdf
    • http://www.gorillawalker.com/man-and-wound-in-the-ancient-world-a-history-of.pdf
    • http://www.gorillawalker.com/oracle-essentials-oracle-database-12c-kindle-edition.pdf
    • http://www.gorillawalker.com/the-process-edge-creating-value-where-it-counts.pdf
    • http://www.gorillawalker.com/digital-broadcasting-iee-telecommunications-series-34.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.