Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec6e8e35a16e9aa1…

MALICIOUS

PDF

33.1 KB Created: 2020-01-16 21:12:04 +03:00 Authoring application: Acrobat PDFMaker 8.1 for Word (via Acrobat Distiller 8.1.0 (Windows))
MD5: 6ff8b2facecc458377aebf0001246040 SHA-1: de62f220fa30a5c936e016448b4d95060d1367f6 SHA-256: ec6e8e35a16e9aa1085b6575e5fc1b9f3e80b3d8c3d6ba0ab1e16b6d7613bec5
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. While no scripts were extracted, the sheer volume of links suggests a malicious intent, possibly for SEO manipulation, phishing, or distributing further malware. The document body contained mostly obfuscated data, providing no direct clues to the user-facing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/against-the-tide-rickover-s-leadership-principles-and-the-rise.pdf
    • http://www.gorillawalker.com/new-jit-new-management-technology-principle.pdf
    • http://www.gorillawalker.com/the-horror-of-the-heights-illustrated-kindle-edition.pdf
    • http://www.gorillawalker.com/c-is-for-corpse-the-kinsey-millhone-alphabet-mysteries.pdf
    • http://www.gorillawalker.com/international-construction-contracts-arbitration-in-the-mena-region-with-a.pdf
    • http://www.gorillawalker.com/the-entrepreneurial-nutritionist-point-lippincott-williams-wilkins.pdf
    • http://www.gorillawalker.com/by-evelyn-thomson-case-studies-in-dental-hygiene-2nd-edition.pdf
    • http://www.gorillawalker.com/bad-girlz-4-life-bad-girlz-book-2-unabridged-audible.pdf
    • http://www.gorillawalker.com/even-greater.pdf
    • http://www.gorillawalker.com/vancouver-island-book-of-musts-the-101-places-every-islander.pdf
    • http://www.gorillawalker.com/yorkshire-terrier-puppies-18-month-2014-calendar-multilingual-edition.pdf
    • http://www.gorillawalker.com/from-particle-systems-to-partial-differential-equations-ii-particle-systems.pdf
    • http://www.gorillawalker.com/notes-on-small-animal-dentistry.pdf
    • http://www.gorillawalker.com/concrete-construction-and-estimating.pdf
    • http://www.gorillawalker.com/quem-mexeu-no-meu-trema-portuguese-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/my-first-story-middlesex-tales.pdf
    • http://www.gorillawalker.com/a-stroke-of-midnight-urban-fantasy-merry-gentry-4-a.pdf
    • http://www.gorillawalker.com/iphone-and-ios-5-advanced-app-development-learn-by-video.pdf
    • http://www.gorillawalker.com/florida-state-seminoles-2012-vintage-football-calendar.pdf
    • http://www.gorillawalker.com/best-bondage-erotica-2015.pdf
    • http://www.gorillawalker.com/snail-eggs-samphire-dispatches-from-the-food-front.pdf
    • http://www.gorillawalker.com/sickle-cell-disease-diseases-and-disorders.pdf
    • http://www.gorillawalker.com/performing-the-sacred-theology-and-theatre-in-dialogue-engaging-culture.pdf
    • http://www.gorillawalker.com/family-feuds-how-to-respond.pdf
    • http://www.gorillawalker.com/narrative-development-in-young-children-gesture-imagery-and-cohesion-digital.pdf
    • http://www.gorillawalker.com/the-legal-system-opposing-viewpoints.pdf
    • http://www.gorillawalker.com/specialty-competencies-in-school-psychology-specialty-competencies-in-professional-psychology.pdf
    • http://www.gorillawalker.com/the-family-jewels-a-gay-comedic-mystery.pdf
    • http://www.gorillawalker.com/the-new-interpreter-s-bible-genesis-to-leviticus-volume-1.pdf
    • http://www.gorillawalker.com/the-rule-of-law-history-theory-and-criticism-law-and.pdf
    • http://www.gorillawalker.com/echo-of-the-soul-the-sacredness-of-the-human-body.pdf
    • http://www.gorillawalker.com/counseling-individuals-through-the-lifespan-counseling-and-professional-identity-digital.pdf
    • http://www.gorillawalker.com/alcoholics-anonymous-2nd-edition.pdf
    • http://www.gorillawalker.com/the-rise-of-the-automated-aristocrats-the-burton-swinburne-adventures.pdf
    • http://www.gorillawalker.com/a-portrait-of-yo-mama-as-a-young-man.pdf
    • http://www.gorillawalker.com/marlowe-four-plays-tamburlaine-parts-one-and-two-the-jew.pdf
    • http://www.gorillawalker.com/handbook-of-politics-in-indian-states-region-parties-and-economic.pdf
    • http://www.gorillawalker.com/orbit-stephen-king.pdf
    • http://www.gorillawalker.com/publishers-directory.pdf
    • http://www.gorillawalker.com/wheater-s-functional-histology-a-text-and-colour-atlas-functional.pdf
    • http://www.gorillawalker.com/fro
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.