Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec50c0096a9eb50c…

MALICIOUS

PDF

41.6 KB Created: 2018-12-15 08:00:36 +03:00 Authoring application: Acrobat PDFMaker 8.1 for Word (via Adobe Acrobat 8.2)
MD5: 49672d74cc78969d3e40547830bc5bfe SHA-1: 2170cfee5c45544e8eeda57475acba2bf392170d SHA-256: ec50c0096a9eb50cffaa9dfc11849fa91223be583526dae1a879031ddc80661f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains a large number of embedded external links, indicating a potential SEO manipulation or content distribution scheme. The primary heuristic identified a 'PDF_SEO_LINK_FARM' with 32 external PDF links, suggesting the document's purpose is to redirect users to a vast array of other documents hosted on the same domain. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/surviving-death-carl-g-hempel-lecture-series.pdf
    • http://www.gorillawalker.com/carbon-neutral-fuels-and-energy-carriers-green-chemistry-and-chemical.pdf
    • http://www.gorillawalker.com/brilliant-marketing-brilliant-business.pdf
    • http://www.gorillawalker.com/porsche-356-owners-workshop-manual-1948-1965.pdf
    • http://www.gorillawalker.com/bible-animal-elephant-keeps-safe.pdf
    • http://www.gorillawalker.com/catalogue-of-the-pepys-library-at-magdalene-college-cambridge-i.pdf
    • http://www.gorillawalker.com/poemas-completos-spanish-edition.pdf
    • http://www.gorillawalker.com/the-kama-sutra-of-vatsyayana-illustrated-edition-kama-sutra-erotic.pdf
    • http://www.gorillawalker.com/nicholas-of-lyra-the-senses-of-scripture-studies-in-the.pdf
    • http://www.gorillawalker.com/multidimensional-analysis-algebras-and-systems-for-science-and-engineering.pdf
    • http://www.gorillawalker.com/wheat-free-classics-breakfast-and-baking-recipes.pdf
    • http://www.gorillawalker.com/p-o-across-the-oceans-across-the-years.pdf
    • http://www.gorillawalker.com/inner-strength-for-active-apostles-how-to-win-souls-without.pdf
    • http://www.gorillawalker.com/lil-bub-2016-wall-calendar.pdf
    • http://www.gorillawalker.com/ghetto-at-the-center-of-the-world-chungking-mansions-hong.pdf
    • http://www.gorillawalker.com/krause-s-food-nutrition-and-diet-therapy.pdf
    • http://www.gorillawalker.com/the-development-of-the-chick-an-introduction-to-embryology-primary.pdf
    • http://www.gorillawalker.com/taks-spiral-content-review-the-americans-reconstruction-to-the-21st.pdf
    • http://www.gorillawalker.com/city-of-night-playlist-book-1.pdf
    • http://www.gorillawalker.com/how-to-become-a-life-coach-the-ultimate-guide-to.pdf
    • http://www.gorillawalker.com/asbestos-for-surveyors.pdf
    • http://www.gorillawalker.com/criminal-investigation-2nd-edition.pdf
    • http://www.gorillawalker.com/document-based-assessment-activities-for-global-history-classes.pdf
    • http://www.gorillawalker.com/paul-the-man-his-life-and-work.pdf
    • http://www.gorillawalker.com/the-winter-serpent-kindle-edition.pdf
    • http://www.gorillawalker.com/iraq-war-the-truth.pdf
    • http://www.gorillawalker.com/digital-holography-digital-hologram-recording-numerical-reconstruction-and-related-techniques.pdf
    • http://www.gorillawalker.com/the-number-file.pdf
    • http://www.gorillawalker.com/castles-and-covenants.pdf
    • http://www.gorillawalker.com/numerical-mathematics-and-computing.pdf
    • http://www.gorillawalker.com/the-alhambra-leather-bound-volume.pdf
    • http://www.gorillawalker.com/revelation-of-st-john-the-path-to-soul-initiation.pdf
    • http://www.gorillawalker.com/hothouse-kids-the-dilemma-of-the-gifted-child.pdf
    • http://www.gorillawalker.com/molly-o-brien-and-the-mark-of-the-dragon-slayer.pdf
    • http://www.gorillawalker.com/culture-and-the-changing-environment-uncertainty-cognition-and-risk-management.pdf
    • http://www.gorillawalker.com/shadowplay-shadowmarch-volume-ii.pdf
    • http://www.gorillawalker.com/orders-to-kill-the-truth-behind-the-murder-of-martin.pdf
    • http://www.gorillawalker.com/invertebrates-classification-evolution-and-biodiversity-animal-science-issues-and-professions.pdf
    • http://www.gorillawalker.com/leonardo-da-vinci-importance-of.pdf
    • http://www.gorillawalker.com/child-pornography-law-and-policy.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.