Malicious PDF — malware analysis report

Static analysis result for SHA-256 eafcab59b851a4c6…

MALICIOUS

PDF

40.6 KB Created: 2018-11-14 23:30:19 +03:00 Authoring application: Adobe Illustrator CS5.1 (via GPL Ghostscript 9.10)
MD5: 34ca39bd2e97ce08e2f620cd751fcf98 SHA-1: fa5327f30a719740d7dafdf080970f2f531242b8 SHA-256: eafcab59b851a4c6145b79efc108db9081edf147e5c6c5e4600f6a1b31d6ead9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be directing users to a vast collection of PDF files hosted on an external domain, likely for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/coal-and-coalbed-gas-fueling-the-future-kindle-edition.pdf
    • http://www.gorillawalker.com/abbot-aelred-carlyle-caldey-island-and-the-anglo-catholic-revival.pdf
    • http://www.gorillawalker.com/css-pocket-reference-kindle-edition.pdf
    • http://www.gorillawalker.com/making-your-first-documentary-out-of-your-own-pocket-book.pdf
    • http://www.gorillawalker.com/point-last-seen-a-road-to-recovery-after-childhood-sexual.pdf
    • http://www.gorillawalker.com/a-socioeconomic-history-of-north-korea.pdf
    • http://www.gorillawalker.com/photography-in-america.pdf
    • http://www.gorillawalker.com/cross-country-running-racing.pdf
    • http://www.gorillawalker.com/winning-em-over.pdf
    • http://www.gorillawalker.com/all-the-people-since-1945-a-history-of-us-book.pdf
    • http://www.gorillawalker.com/backcountry-adventure-guide-to-the-mount-zirkel-wilderness-a-mountain.pdf
    • http://www.gorillawalker.com/cybernetics-simulation-and-conflict-resolution-proceedings-of-the-third-annual.pdf
    • http://www.gorillawalker.com/a-year-with-the-church-fathers.pdf
    • http://www.gorillawalker.com/the-arts-and-crafts-movement.pdf
    • http://www.gorillawalker.com/the-mill-river-recluse-a-novel-kindle-edition.pdf
    • http://www.gorillawalker.com/passing-through-recovery-from-diabetes-and-food-addiction.pdf
    • http://www.gorillawalker.com/piano-quartet-no-1-in-e-flat-major-woo-36.pdf
    • http://www.gorillawalker.com/grindhouse-purgatory-issue-5.pdf
    • http://www.gorillawalker.com/crow-boy-picture-puffins.pdf
    • http://www.gorillawalker.com/federal-bail-and-detention-handbook.pdf
    • http://www.gorillawalker.com/topology-university-mathematical-texts.pdf
    • http://www.gorillawalker.com/oral-and-maxillofacial-surgery-deformity-defects-chinese-edition.pdf
    • http://www.gorillawalker.com/monster-high-en-espa-ol-monster-high-playaway-spanish-edition.pdf
    • http://www.gorillawalker.com/rules-for-discerning-the-spirits.pdf
    • http://www.gorillawalker.com/the-rise-and-fall-of-maya-civilization.pdf
    • http://www.gorillawalker.com/a-call-to-a-deeper-love-the-family-correspondence-of.pdf
    • http://www.gorillawalker.com/how-to-teach-the-bible-kindle-edition.pdf
    • http://www.gorillawalker.com/wiffle-ball-the-ultimate-guide.pdf
    • http://www.gorillawalker.com/to-lhasa-in-disguise-adventure-travel-classics.pdf
    • http://www.gorillawalker.com/swiss-alps-motorcycle-touring-guide.pdf
    • http://www.gorillawalker.com/auditing-corporate-accounting.pdf
    • http://www.gorillawalker.com/children-s-book-of-baking-usborne-cookbooks.pdf
    • http://www.gorillawalker.com/choir-of-angels-shirley-goodness-and-mercy-those-christmas-angels.pdf
    • http://www.gorillawalker.com/blackmailed-bride-innocent-wife-harlequin-comics.pdf
    • http://www.gorillawalker.com/chained-to-the-bondage-wall-the-billionaire-series-book-7.pdf
    • http://www.gorillawalker.com/the-selected-poems-of-robert-desnos-modern-european-poetry-series.pdf
    • http://www.gorillawalker.com/nlp-the-essential-guide-to-neuro-linguistic-programming.pdf
    • http://www.gorillawalker.com/ten-in-the-bed-read-and-sing-along-read-sing.pdf
    • http://www.gorillawalker.com/lillian-wald-of-henry-street.pdf
    • http://www.gorillawalker.com/imperialism-and-world-politics.pdf
    • http://www.gorillawalker.com/photography
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.