Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecde49da909f2f2a…

MALICIOUS

PDF

44.6 KB Created: 2019-03-16 08:53:57 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 8.1.0 (Windows))
MD5: c3fcca3b117f0c736627bb69611ae503 SHA-1: c6685ae7c70597255e3f7a0e18ea887f1f7350fe SHA-256: ecde49da909f2f2a31258529e22b39bd9ba2f94e037f5ca2074ef9c492fb3eeb
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF was flagged by a machine learning classifier as malicious. It contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection attempt. The document body is heavily obfuscated and unreadable, providing no further context on the specific lure. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9016

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/superaci-n-personal-rompiendo-el-silencio-que-lleva-dentro-spanish.pdf
    • http://www.gorillawalker.com/ceramic-petrography-the-interpretation-of-archaeological-pottery-related-artefacts-in.pdf
    • http://www.gorillawalker.com/plymouth-cock.pdf
    • http://www.gorillawalker.com/the-greatest-direct-mail-sales-letters-of-all-time.pdf
    • http://www.gorillawalker.com/child-in-islam.pdf
    • http://www.gorillawalker.com/exam-practice-cd-for-cody-kelley-arney-s-comprehensive-medical.pdf
    • http://www.gorillawalker.com/leveraged-buyout-of-any-business-step-by-step-become-a.pdf
    • http://www.gorillawalker.com/discrete-mathematics-universitext.pdf
    • http://www.gorillawalker.com/simulated-hummels-secrets-to-beautiful-translucents-simplified-step-by-step.pdf
    • http://www.gorillawalker.com/pharmaceutical-process-validation-drugs-and-the-pharmaceutical-sciences.pdf
    • http://www.gorillawalker.com/amadeus-the-leghorn-rooster-young-palmetto-books.pdf
    • http://www.gorillawalker.com/totally-weird-erotica.pdf
    • http://www.gorillawalker.com/mental-health-aspects-of-custody-law.pdf
    • http://www.gorillawalker.com/myth-and-religion-a-thorn-in-the-flesh-paperback.pdf
    • http://www.gorillawalker.com/fundamental-aspects-of-operational-risk-and-insurance-analytics-and-advances.pdf
    • http://www.gorillawalker.com/changing-lenses-a-new-focus-for-crime-and-justice-christian.pdf
    • http://www.gorillawalker.com/hole-s-essentials-of-human-anatomy-and-physiology-seventh-edition.pdf
    • http://www.gorillawalker.com/the-living-god-a-catechism-vol-1.pdf
    • http://www.gorillawalker.com/antitrust-aspen-treatise.pdf
    • http://www.gorillawalker.com/ciao-secondo-quaderno-english-and-italian-edition.pdf
    • http://www.gorillawalker.com/war-a-shadowrun-sourcebook.pdf
    • http://www.gorillawalker.com/belligerent-vicara-volume-1.pdf
    • http://www.gorillawalker.com/handbook-on-innovation-systems-and-developing-countries-building-domestic-capabilities.pdf
    • http://www.gorillawalker.com/voice-enabling-web-applications-voicexml-and-beyond-with-cd-rom.pdf
    • http://www.gorillawalker.com/totally-thai-classic-thai-recipes-to-make-at-home-kindle.pdf
    • http://www.gorillawalker.com/texts-from-the-buddhist-canon-commonly-known-as-dhammapada-with.pdf
    • http://www.gorillawalker.com/food-chains-las-cadenas-alimentarias-bookworms-nature-s-cycles-bookworms.pdf
    • http://www.gorillawalker.com/doctor-who-city-of-death-a-4th-doctor-novelisation.pdf
    • http://www.gorillawalker.com/drugs-of-abuse-pharmacology-and-molecular-mechanisms.pdf
    • http://www.gorillawalker.com/profit-from-payroll-how-to-transform-a-business-cost-into.pdf
    • http://www.gorillawalker.com/top-r-b-singles-1942-1995-hardcover-top-r-b.pdf
    • http://www.gorillawalker.com/narciso-hermetico-sor-juana-ines-de-la-cruz-y-jose.pdf
    • http://www.gorillawalker.com/reticulated-pythons-world-s-largest-snakes.pdf
    • http://www.gorillawalker.com/a-handful-of-idiots-and-a-bunch-of-bears-bear.pdf
    • http://www.gorillawalker.com/matza-101-an-innovative-cookbook-containing-101-creative-recipes-simply.pdf
    • http://www.gorillawalker.com/pmi-sp-scheduling-professional-exam-preparation-workbook-part-of-the.pdf
    • http://www.gorillawalker.com/abnormal-psychology-in-s-changing-world-books-a-la-carte.pdf
    • http://www.gorillawalker.com/healthy-breakfast-recipes.pdf
    • http://www.gorillawalker.com/thinspo.pdf
    • http://www.gorillawalker.com/full-color-frames-and-borders-cd-rom-and-book-dover.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.